CVE-2026-69264 FlowiseAI CVE debrief

Who should care

Flowise users and administrators, particularly those with chatflows:create or agentflows/chatflows update permissions, should assess their exposure and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-69264 is a critical vulnerability in Flowise that allows for remote code execution. Flowise users and administrators should assess their exposure and take steps to mitigate the vulnerability.

• Remote code execution is possible, allowing attackers to execute arbitrary file I/O or OS commands as the Flowise process.
• Unauthenticated requests can trigger the vulnerability, increasing the attack surface.
• The vulnerability can be exploited by a workspace user with chatflows:create or agentflows/chatflows update permission.
• Verification of affected versions and remediation efforts are necessary to prevent exploitation.

Technical summary

The vulnerability is caused by the interpolation of attacker-controlled CSV data into a Python source-code template, which is then executed by Pyodide. This allows an attacker to break out of the Python string literal and execute arbitrary JavaScript code, potentially leading to remote code execution. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution.

Defensive priority

High

Recommended defensive actions

• Upgrade to Flowise version 3.1.3 or later
• Restrict access to chatflows and CSV Agent nodes
• Monitor for suspicious activity and unauthenticated requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 9.4 and severity of CRITICAL. The vendor has released a fix in version 3.1.3. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. Evidence is limited; defenders should verify affected versions, review chatflow configurations, and monitor

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.