Flowise Turns Prompt Injection Into RCE. The CSV Agent Is the Weapon
- The Mess: Flowise turns an attacker-controlled prompt into Python code inside its CSV Agent. The resulting code runs in an unsandboxed Pyodide environment.
- The Damage: A remote attacker can execute arbitrary code on the Flowise server without authentication.
- The Fix: Upgrade Flowise to 3.1.3 immediately and treat exposed AI flows as compromised until checked.
Flowise is supposed to make building LLM workflows easier. CVE-2026-70477 demonstrates the other side of that convenience: once untrusted data reaches an AI agent that can generate executable code, the prompt itself becomes an attack primitive.
The vulnerability sits in the CSV_Agents implementation. An attacker can inject data into a chatflow using the CSV Agent and manipulate the LLM into producing a malicious Python payload. Flowise then passes that generated code toward its Python execution path.
The security boundary was the validator.
It was not enough.
The generated Python could bypass the blocklist validation and execute inside Pyodide without a proper sandbox. The result is not another harmless prompt-injection bug. It is remote code execution in the context of the Flowise service account.
No Login. No Click.
ZDI rates CVE-2026-70477 at 9.8 Critical, with network attack vector, low complexity, no privileges required and no user interaction required.
That combination matters.
An exposed Flowise installation is not merely serving an attacker-controlled prompt. It can become the execution environment for the attacker’s code.
Depending on how Flowise is deployed, that can mean access to application secrets, environment variables, connected services, local files and anything else available to the service account.
The AI Agent Is the Attack Surface
The interesting part is not simply that Flowise had a Python bug.
The attack chain crosses several trust boundaries:
Untrusted input → LLM prompt → generated Python → validator → Pyodide execution
Every stage assumes the previous one produced something safe.
The attacker only needs to break that assumption once.
This is exactly why treating LLM-generated code as trusted output is dangerous. A model can generate syntax. It cannot establish whether that syntax is safe to execute.
Fixed in Flowise 3.1.3
Flowise fixed CVE-2026-70477 in version 3.1.3. The vendor advisory lists versions up to 3.1.2 as affected.
The fix was implemented in the Flowise codebase through commit f4e2794f6a576b94578f2fdafbf49c2fb304626c.
Administrators should:
- upgrade Flowise to 3.1.3 or later;
- review externally accessible Flowise instances;
- inspect CSV Agent chatflows;
- rotate secrets available to the Flowise process if exploitation is suspected;
- review server logs for unexpected Flowise executions and outbound connections;
- avoid running Flowise with unnecessary filesystem or network privileges.
And there is another reason to update immediately: CVE-2026-70477 is not the only security issue fixed around Flowise 3.1.3. The project has disclosed several other flaws affecting the same release line.
Bugstoday Opinion
Flowise did not need a kernel exploit to get into trouble.
It gave an AI agent a route from hostile input to executable Python and tried to police the output with a blacklist.
That is a terrible security boundary.
If your AI workflow can execute generated code, assume the model output is hostile by default. Otherwise, sooner or later, somebody will turn a prompt into a shell.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
TrendAI Zero Day Initiative — ZDI-26-634
FlowiseAI Security Advisory — GHSA-5xvg-pmgg-3mxr
CVE-2026-70477
FlowiseAI GitHub — security fix commit
