CVE-2026-70477 FlowiseAI CVE debrief

Who should care

Users of Flowise, especially those using versions prior to 3.1.3, should apply the patch and monitor for suspicious activity. This includes reviewing system logs for potential exploitation attempts and ensuring that the service is properly configured and secured. Security teams should prioritize patching and verify the integrity of their Flowise deployments. Additionally, operators and administrators of affected systems should be aware of the potential risks and take necessary precautions to prevent exploitation. Vulnerability management teams should assess the impact of this vulnerability on their organization's assets and prioritize remediation efforts accordingly. Platform administrators should ensure that proper security controls are in place to detect and prevent potential attacks. This may involve reviewing access controls, monitoring system logs, and implementing additional security measures as needed. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. This includes implementing monitoring and detection capabilities to identify potential exploitation attempts and ensuring that incident response plans are in place in case of a security incident. Asset inventory management teams should ensure that accurate records of Flowise deployments are maintained, and that affected systems are properly tracked and prioritized for remediation. Rollback and change management processes should be reviewed to ensure that changes to Flowise deployments are properly controlled and validated. Source tracking and monitoring should be implemented to detect and respond to potential security incidents related to Flowise deployments. By taking these precautions, organizations can help prevent exploitation of this vulnerability and minimize potential risks. Security teams should also consider implementing additional security measures, such as network segmentation and access controls, to further reduce the risk of exploitation. By prioritizing patching and taking proactive steps to secure Flowise deployments, organizations can help protect their assets and minimize potential risks associated with this vulnerability

Technical summary

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment. The vulnerability exists due to the use of untrusted data in constructing an LLM prompt.

Defensive priority

Critical vulnerability in Flowise, a drag & drop user interface to build a customized large language model flow, allows for arbitrary code execution.

Recommended defensive actions

• Apply the patch from version 3.1.3
• Restrict access to the Flowise service
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The specific flaw exists within the run method of the CSV_Agents class, where untrusted data is used to construct an LLM prompt and the resulting pythonCode is validated by validatePythonCodeForDataFrame before execution. The vulnerability allows for arbitrary code execution in the context of the service account. Users should verify the patch is applied and monitor for suspicious activity related to the Flowise service.

Official resources