The vulnerability (CVE-2026-69256) in FlowiseAI Flowise affects versions before 3.1.3. The CSVAgent node permits users to supply Python code executed through pyodide. Although a denylist attempts to block dangerous Python constructs, it fails to prevent the use of pandas.read_pickle(), which can deserialize malicious pickled payloads leading to arbitrary code execution. The vulnerable code evaluates user input as pd.${customReadCSVFunc} in flowise-components/nodes/agents/CSVAgent/CSVAgent.ts. An authenticated user able to create or modify chatflows can exploit this by adding a CSV Agent with a malicious read_pickle payload and triggering the /api/v1/prediction/<UUID> endpoint, resulting in command execution. The vulnerability is resolved in version 3.1.3.

An authenticated user with privileges to create or modify chatflows can execute arbitrary code on the system running Flowise by exploiting this vulnerability. This can lead to full system compromise, data theft, or disruption of service. The CVSS 4.0 score of 9.4 reflects the critical severity, with network attack vector, low attack complexity, no user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements.

Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed. No other mitigations are indicated in the advisory. Since this is not a cloud service, users must apply the patch themselves.