EXPOSURES › CVE-2026-70477
CVE-2026-70477
CRITICALCVE-2026-70477 in Flowise allows prompt injection via CSV Agent nodes to execute arbitrary Python code in an unsandboxed Pyodide environment.
An attacker can bypass the blocklist validator by sending a malicious prompt that causes the LLM to respond with a Python script, which executes in an unsandboxed environment. This is a critical RCE vulnerability that compromises the service account context and violates NIST 800-171 requirements for preventing unauthorized access and ensuring system integrity. DIB organizations must patch to version 3.1.3 immediately and restrict untrusted data inputs to LLM prompts.
Shame score — The flaw allowed arbitrary code execution in an unsandboxed environment, indicating a severe lack of input validation and sandboxing in a LLM orchestration tool.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment. The specific flaw exists within the run method of the CSV_Agents class, where untrusted data is used to construct an LLM prompt and the resulting pythonCode is validated by validatePythonCodeForDataFrame before execution. An attacker can leverage this to execute arbitrary code in the context of the service account. This issue is fixed in 3.1.3.