Code Execution Vulnerability in Flowise Drag & Drop Interface

CVE-2026-69256

What is CVE-2026-69256?

Flowise, a user-friendly interface for building customized large language models, has a vulnerability in its CSVAgent node. Prior to version 3.1.3, it permitted the execution of unauthorized Python code through the use of a 'read_pickle' payload, bypassing strict denylist checks. An authenticated user, capable of modifying chatflows, could exploit this vulnerability by inserting malicious commands in the Additional Parameters field associated with the CSV Agent. The execution occurs when a specific API endpoint is triggered, compromising the integrity of the application and allowing potential manipulation of server-side behavior.

References