Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

August 11th, 2026
ZDI-26-545 ZDI-CAN-30461

CVE ID

CVE-2026-69256

CVSS Score

8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Flowise

Affected Products

Flowise

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is required to exploit this vulnerability.

The specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account.

Additional Details

Flowise has issued an update to correct this vulnerability. More details can be found at:
https://github.com/FlowiseAI/Flowise/pull/6257/changes/01ac3d644a197402c454cf7becb43223e6ec8715

Disclosure Timeline

  • 2026-04-22 - Vulnerability reported to vendor
  • 2026-08-11 - Coordinated public release of advisory
  • 2026-08-11 - Advisory Updated

Credit

Dre Cura (@dre_cura) of TrendAI Research

Back to Advisories