Flowise, a drag-and-drop interface for building customized large language model flows, had a vulnerability in its CSVAgent component before version 3.1.3. The component extracted CSV data using file.split(',').pop() and directly interpolated this data into Python code executed via Pyodide without proper validation. The existing denylist validatePythonCodeForDataFrame() only checked later LLM-generated code, not the initial code block containing the injected data. An authenticated attacker could inject a closing quote and arbitrary Python code, leveraging Pyodide's JavaScript bridge to access Node.js child_process and execute OS commands as root within the container. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code).

An authenticated attacker can achieve remote code execution with root privileges inside the Flowise container by injecting malicious Python code through specially crafted CSV data. This can lead to full system compromise of the container environment running Flowise.

This vulnerability is fixed in Flowise version 3.1.3. Users should upgrade to version 3.1.3 or later to remediate this issue. No other mitigation steps are indicated by the vendor advisory.