Prompt Injection Vulnerability in Flowise Drag & Drop Interface
CVE-2026-70477

9.5CRITICAL

Key Information:

Vendor: Flowiseai
Status: Flowise
Vendor: CVE Published:; 4 August 2026

What is CVE-2026-70477?

A vulnerability exists in Flowise, where the drag-and-drop user interface allows for a prompt injection through a CSV Agent node. This flaw enables an attacker to send crafted inputs that result in the execution of a malicious Python script. The vulnerability arises when untrusted data is used within the run method of the CSV_Agents class, which can lead to arbitrary code being executed in an unsandboxed environment. The issue has been addressed in version 3.1.3.