Input validation error in Flowise - #VU140060
Published: July 30, 2026
Vulnerability identifier: #VU140060
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in the run method of the CSV_Agents class when processing a crafted chatflow using a CSV Agent node with a malicious customReadCSV value. A remote user can send a crafted chatflow and trigger internal prediction to execute arbitrary code.
Python code executes in an unsandboxed pyodide environment in the context of the user running the server.
Affected software
Flowise
Remediation
Install security update from vendor's website.
Flowise - update to 3.1.3