Prompt injection in Flowise CSV Agents enables remote code execution via Python scripts

Summary

Flowise, an open-source tool used to build AI applications and chatbots through a drag-and-drop interface, is vulnerable to a critical remote code execution (RCE) flaw. The vulnerability, identified as CVE-2026-41264, resides in the run method of the CSV_Agents class.

Attackers can exploit this by sending specifically crafted prompts to a chatflow that uses a CSV Agent node. This allows them to bypass existing security filters and execute commands with the same privileges as the user running the Flowise server.

Technical details

The vulnerability exists because of how the CSV_Agents class handles Python code generation. When a user queries a chatflow using a CSV Agent, the system generates a Python script intended to be executed within a Pyodide environment. This script is designed to use the pandas library to analyze the uploaded CSV data.

To prevent malicious activity, Flowise employs a function called validatePythonCodeForDataFrame(). This function checks the generated code against a list of forbidden patterns, such as attempts to import modules other than pandas or numpy. However, this validation can be bypassed through clever prompting.

An attacker can bypass these filters by importing a restricted module alongside an allowed one using an alias. For example, by executing import pandas as np, os as pandas, the os module is successfully loaded under the name pandas. Once loaded, the attacker can call system commands via pandas.system(), effectively escaping the intended sandbox and gaining control over the underlying operating system.

Affected products and fixed versions

The vulnerability affects Flowsise versions 1.3.0 through 3.0.13.

Proof of Concept

The vulnerability can be triggered by providing a prompt that forces the LLM to generate code containing an alias for a restricted module. An example of this bypass technique is:

import pandas as np, os as pandas
pandas.system("xcalc")

A working exploit module has been developed for the Metasploit Framework to demonstrate this RCE capability. The module can be found here: https://github.com/rapid7/metasploit-framework/pull/21407

Why this matters for defenders

This flaw is particularly dangerous because it does not require Flowise authentication to trigger the underlying vulnerability, though an attacker would need an API key with chatflows:create permissions to use the specific Metasploit module described.

Because the code execution occurs in the context of the user running the server, a successful exploit could grant an attacker full control over the host environment. If Flowise is running as a root or administrative user, the impact is total system compromise.

Defender guidance

The primary defense against this vulnerability is to update your Flowise installation to version 3.1.0 or later. This version addresses the insufficient sandboxing and improves how Python code is evaluated.

If immediate patching is not possible, monitor for unusual process activity originating from the Flowise service, particularly unexpected calls to system shells or unauthorized module imports within the application logs.