Skip to content
Threat Feed
Subscribe

Product

Flowise (<= 3.1.2)

2 briefs RSS
critical advisory

Remote Code Execution in Flowise CSVAgent via pandas.read_pickle

A critical remote code execution vulnerability (CVE-2026-69256) in the Flowise CSVAgent node allows attackers to bypass security filters by deserializing malicious pickled payloads using pandas.

flowise +2 rce python deserialization web-security ssrf web-application cloud auth-bypass +2
2r 4t 1c
critical advisory

FlowiseAI Flowise CSV Agent Prompt Injection RCE Vulnerability

A remote code execution vulnerability exists in FlowiseAI Flowise version 3.0.13 due to insufficient sandboxing when evaluating LLM-generated Python scripts, allowing unauthenticated attackers to inject malicious code via prompts processed by the CSV Agent node, bypassing input validation, to execute arbitrary OS commands.

Flowise +1 rce prompt-injection
2r 1t 4c updated