Code Injection in Flowise - CVE-2026-69255
Published: July 30, 2026
Vulnerability identifier: #VU140055
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69255
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in the CSVAgent.ts CSV Agent component when processing a crafted CSV data URI. A remote user can inject Python code into the interpolated base64_string value to execute arbitrary code.
The issue can be leveraged through the Pyodide js bridge to reach the host Node.js process, and the supplied payload cannot contain commas because the input is split on commas.
Affected software
Flowise
How to mitigate CVE-2026-69255
Install security update from vendor's website.
Flowise - update to 3.1.3