FlowiseAI Flowise versions before 3.1.3 contain a CWE-94 improper control of code generation vulnerability in the CSVAgent node. The node evaluates user-supplied Python code through pyodide, specifically in the customReadCSVFunc parameter, which is executed as pd.${customReadCSVFunc}. Although a denylist attempts to block dangerous Python constructs, it does not prevent the use of pandas.read_pickle(), which can deserialize malicious pickled payloads to achieve code execution. An authenticated user able to create or modify chatflows can exploit this by adding a CSV Agent with a malicious read_pickle payload in the Additional Parameters and triggering the /api/v1/prediction/<UUID> endpoint, resulting in arbitrary command execution. The issue is resolved in Flowise version 3.1.3.

An authenticated user with permissions to create or modify chatflows can execute arbitrary code on the system running Flowise by exploiting the deserialization of malicious pickled data via pandas.read_pickle(). This can lead to full system compromise depending on the privileges of the Flowise process. The vulnerability has a high CVSS 4.0 score of 9.4, indicating critical impact with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until patched, restrict authenticated user permissions to prevent unauthorized creation or modification of chatflows. Monitor vendor advisories for any additional guidance.