CVE-2026-70477: CWE-94: Improper Control of Generation of Code ('Code Injection') in FlowiseAI Flowise
CVE-2026-70477 is a critical code injection vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The flaw allows an attacker to send a crafted prompt to a chatflow using a CSV Agent node, causing the large language model to generate and execute malicious Python code in an unsandboxed Pyodide environment. This occurs because untrusted data is used to build the LLM prompt and the resulting code validation is bypassed. The vulnerability is fixed in version 3.1.3.
AI Analysis
Technical Summary
FlowiseAI Flowise before version 3.1.3 contains a CWE-94 improper control of code generation vulnerability in the run method of the CSV_Agents class. An attacker can craft a prompt injection targeting a chatflow with a CSV Agent node, which leads the LLM to produce malicious Python code that bypasses the validatePythonCodeForDataFrame blocklist validator. This code executes in an unsandboxed Pyodide environment, allowing arbitrary code execution with the privileges of the service account. The issue is resolved in Flowise version 3.1.3.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary Python code within the context of the service account running Flowise, potentially leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability due to the high privileges and unsandboxed execution environment.
Mitigation Recommendations
Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 3.1.3.
CVE-2026-70477: CWE-94: Improper Control of Generation of Code ('Code Injection') in FlowiseAI Flowise
Description
CVE-2026-70477 is a critical code injection vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The flaw allows an attacker to send a crafted prompt to a chatflow using a CSV Agent node, causing the large language model to generate and execute malicious Python code in an unsandboxed Pyodide environment. This occurs because untrusted data is used to build the LLM prompt and the resulting code validation is bypassed. The vulnerability is fixed in version 3.1.3.
CVSS v4.0
Score 9.5critical
Affected software
FlowiseAI
Flowise
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FlowiseAI Flowise before version 3.1.3 contains a CWE-94 improper control of code generation vulnerability in the run method of the CSV_Agents class. An attacker can craft a prompt injection targeting a chatflow with a CSV Agent node, which leads the LLM to produce malicious Python code that bypasses the validatePythonCodeForDataFrame blocklist validator. This code executes in an unsandboxed Pyodide environment, allowing arbitrary code execution with the privileges of the service account. The issue is resolved in Flowise version 3.1.3.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary Python code within the context of the service account running Flowise, potentially leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability due to the high privileges and unsandboxed execution environment.
Mitigation Recommendations
Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 3.1.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-04T15:24:41.339Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a724791bf8831d5396138df
Added to database: 08/04/2026, 20:12:01 UTC
Last enriched: 08/12/2026, 15:50:27 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 152
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.