Remote Code Execution in Flowise CSVAgent via pandas.read_pickle

Flowise versions 3.1.2 and below contain a remote code execution (RCE) vulnerability in the CSVAgent node (CVE-2026-69256). The component was designed to allow users to process CSV data via the pandas library while restricting potentially dangerous Python constructs through a denylist-based validation mechanism. However, the existing filter fails to account for the pandas read_pickle() function, which can be leveraged to deserialize arbitrary data. By crafting a malicious pickle payload that triggers OS-level execution (e.g., via os.system) and providing it through the customReadCSVFunc parameter, an attacker can bypass all configured security checks. Since the environment lacks standard I/O modules due to the filter, attackers can implement custom file-like classes to bridge the object into the read_pickle() function, successfully achieving full system command execution.

Attack Chain

1. Attacker creates a malicious pickle object containing a payload designed to execute arbitrary shell commands (e.g., os.system).
2. The payload is encoded in base64 to ensure successful transport within the Flowise input parameters.
3. The attacker defines a custom Python class (e.g., MiniBytesIO) within the customReadCSVFunc parameter to simulate a file-like object, bypassing constraints on importing standard library I/O modules.
4. The attacker injects the encoded pickle string into the read_pickle() call within the customReadCSVFunc parameter in the Flowise UI.
5. The Flowise CSVAgent node accepts the user-supplied input, as it does not explicitly filter for read_pickle or the required pickle-loading logic.
6. The pyodide execution environment processes the provided string and invokes pandas.read_pickle().
7. The pickle deserialization occurs, triggering the __reduce__ method of the malicious object and executing the embedded shell commands.
8. The attacker triggers the execution by sending a POST request to the prediction endpoint (/api/v1/prediction/<UUID>), resulting in unauthorized command execution on the host.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary commands with the privileges of the Flowise application process. This can lead to full system compromise, exfiltration of sensitive configuration or chat data, and potential lateral movement within the environment.

Recommendation

• Upgrade Flowise and the flowise-components package to version 3.1.3 or higher to apply the vendor-provided patch.
• Apply the following webserver detection rule to identify and block incoming requests targeting the prediction endpoint with suspicious customReadCSVFunc payloads.
• Implement egress filtering on the Flowise host to restrict unexpected network connections originating from the application process, mitigating the impact of successful RCE (e.g., reverse shells).