Threats tagged 'ghsa-vmv7-4m6c-3cg5'

CVE-2026-69255 is a critical code injection vulnerability in Flowise versions prior to 3.1.3. It arises from improper handling of attacker-controlled CSV data in the CSVAgent component, where unvalidated input is interpolated directly into executable Python code. This flaw allows an authenticated attacker to execute arbitrary operating system commands with root privileges in the Flowise container. The issue is fixed in version 3.1.3.