In FlowiseAI Flowise versions before 3.1.3, the CSVAgent component interpolates attacker-controlled segments of the csvFile data URI directly into a Python source-code template executed by Pyodide. Because Pyodide uses a default JavaScript bridge exposing powerful Node.js functions such as eval and dynamic import, an attacker can escape the Python string context to execute arbitrary JavaScript code. This enables dynamic import of Node.js built-in modules like fs and child_process, allowing arbitrary file I/O and OS command execution as the Flowise process. The vulnerability bypasses existing validators as they are not applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permissions can plant a malicious CSV Agent node. Once the chatflow is exposed via the POST /api/v1/prediction/:id endpoint, any unauthenticated request triggers remote code execution. The vulnerability is resolved in Flowise version 3.1.3.

An attacker with limited workspace permissions can achieve unauthenticated remote code execution on the host running Flowise by exploiting this vulnerability. This allows arbitrary file system access and OS command execution, leading to full compromise of the Flowise process environment. The vulnerability has a CVSS 4.0 score of 9.4 (critical), indicating high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Flowise version 3.1.3. Users should upgrade to version 3.1.3 or later to remediate this issue. No official temporary fixes or workarounds are provided. Until upgrading, restrict permissions to trusted users only and avoid exposing the vulnerable API endpoint to untrusted networks.