Because Flowise defaults to an unauthenticated state, a remote attacker can interact with the API to register a malicious MCP server. By including specific environment variables in the configuration, an attacker can influence the behavior of npx, node, or python3 to achieve remote code execution. This is a classic case of incomplete denylisting, where developers attempted to enumerate dangerous inputs rather than implementing a secure allowlist, leaving the environment vulnerable to various configuration injection vectors.

Attack Chain

1. Attacker discovers an internet-facing, unauthenticated Flowise instance.
2. Attacker interacts with the Flowise API to create or update an MCP server configuration.
3. Attacker crafts a JSON payload containing the mcpServers object with a command like npx.
4. Attacker inserts environment variables such as npm_config_yes=true into the env field of the payload.
5. Flowise validation logic (validateCommandFlags) is bypassed because the CLI flags are clean.
6. Flowise validation logic (validateEnvironmentVariables) is bypassed because the blocklist only contains four hardcoded entries (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS).
7. Flowise spawns the npx process, which reads the injected environment variable and proceeds with automatic package installation.
8. Malicious code is executed under the privileges of the Flowise process, resulting in full system compromise.

Impact

Successful exploitation results in unauthenticated remote code execution on the server running Flowise. Given the tool's nature as an LLM integration platform, successful compromise often grants an attacker access to connected sensitive data, API keys for AI providers, and internal network resources. All versions up to and including 3.1.2 are confirmed to be vulnerable.

Recommendation

1. Upgrade to a version of Flowise that implements an allowlist-based validation approach for environment variables rather than a denylist.
2. Implement strict authentication on all Flowise API endpoints to prevent unauthenticated access to configuration interfaces.
3. Restrict outbound network access for the server running Flowise to prevent the automatic installation of arbitrary npm/pip packages from the internet.
4. Ensure that the service account running the Flowise process operates with the principle of least privilege, minimizing the damage from a successful code execution event.

Attack Chain

1. An attacker crafts a malicious prompt designed to exploit the CSV Agent node in Flowise.
2. The attacker sends the crafted prompt to a chatflow that utilizes the vulnerable CSV Agent node.
3. The run method of the CSV_Agents class is invoked, processing the attacker-supplied prompt.
4. The system prompt, including the user's injected payload, is sent to an LLM to generate a Python script.
5. The LLM generates a Python script containing malicious code, bypassing the FORBIDDEN_PATTERNS validation (e.g., importing os with an alias).
6. The generated Python code, including the injected malicious commands (e.g., pandas.system("xcalc")), is executed within a pyodide environment, lacking sufficient sandboxing.
7. The attacker-controlled command is executed on the Flowise server, in the context of the user running the server.
8. The attacker achieves arbitrary code execution, potentially leading to system compromise, data exfiltration, or denial of service.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the Flowise server. This can lead to a full system compromise, allowing the attacker to steal sensitive data, install malware, or disrupt services. Given Flowise's role in LLM application development, a successful attack could compromise sensitive data used by these models, or introduce malicious functionality into the models themselves. The number of affected installations is unknown, but any Flowise instance running version 3.0.13 or earlier with the CSV Agent node exposed is potentially vulnerable.

Recommendation

• Upgrade Flowise to a patched version greater than 3.0.13 to remediate CVE-2026-41264.
• Deploy the Sigma rule "Detect Suspicious Flowise CSV Agent Execution" to detect attempts to exploit this vulnerability via process creation from unexpected locations.
• Review and harden the FORBIDDEN_PATTERNS list in the validatePythonCodeForDataFrame() function to prevent bypasses, referencing the details in the overview.
• Monitor network connections originating from the Flowise server for suspicious outbound traffic using the "Detect Outbound Connection from Flowise Server" Sigma rule.