CVE Intelligence
Analysis AI-assisted

CVE-2026-41264: Flowise CSV Agent Prompt Injection Leading to Remote Code Execution

Flowise, a drag and drop interface for building LLM flows, has a flaw in the run method of the CSV_Agents class where LLM-generated Python scripts are evaluated without proper sandboxing. Through prompt injection, an attacker may cause the model to return a malicious script that runs commands on the server. The record rates the issue critical with a CVSS score of 9.8 from NVD, and the fix is in 3.1.0.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Flowise is a drag and drop interface for building customized large language model flows. The record describes a flaw in the run method of the CSV_Agents class, where a Python script generated by an LLM is evaluated without adequate sandboxing. Through prompt injection, a party able to send prompts to a chatflow that uses the CSV Agent node may influence the model output. See the GitHub advisory.

Impact

  • Code execution in the context of the user running the Flowise server, as described in the record.
  • The record rates the issue critical, with a CVSS score of 9.8 from NVD and a vector indicating high confidentiality, integrity and availability impact.
  • The record states that the described prompt path is reachable by an unauthenticated attacker.

Affected products and versions

  • Product: Flowiseai Flowise.
  • Versions before 3.1.0 are listed as affected.
  • The record identifies 3.1.0 as the fixed version.

Exploitation status

CISA KEV does not list this CVE according to the record. No confirmed exploitation in the wild appears in the sources consulted. The GitHub advisory reference carries an Exploit tag, which classifies the link and does not confirm real-world use. The EPSS probability is 0.01439.

Remediation and mitigation

  • Upgrade Flowise to 3.1.0 or later, the version the record identifies as the fix.
  • Until the upgrade is applied, consider restricting who can reach chatflows that use the CSV Agent node, and disable that node where it is not needed. This is general guidance, not a vendor-confirmed workaround.
  • Run the server with least privilege and restrict its outbound network access.

Detection guidance

  • Review chatflow activity that uses the CSV Agent node for unusual prompts or unexpected outputs.
  • Monitor the Flowise server process for unexpected child processes or network connections.

Limitations of the available information

The record does not provide a CWE name, technical detail beyond the summary, or a confirmed workaround. Exploitation status beyond the absence of a KEV listing is not established by the consulted sources.

Frequently asked questions

Which Flowise versions are affected by this CVE?

According to the record, versions before 3.1.0 are affected, and 3.1.0 is the fixed version.

Is this vulnerability known to be exploited in the wild?

No. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade Flowise to 3.1.0 or later. Until then, consider limiting access to chatflows that use the CSV Agent node and reviewing server activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.