Summary
Flowise's CSVAgent node allows authenticated users with chatflow management access to provide Python-related code that is evaluated through Pyodide. Because a denylist can be bypassed through pandas pickle deserialization, a crafted chatflow may execute arbitrary commands when its prediction endpoint is triggered.
Flowise's CSVAgent node allows authenticated users with chatflow management access to provide Python-related code that is evaluated through Pyodide. Because a denylist can be bypassed through pandas pickle deserialization, a crafted chatflow may execute arbitrary commands when its prediction endpoint is triggered.
Affected context
The vulnerability occurs in Flowise deployments using the CSVAgent node, where the custom CSV-reading function supplied through Additional Parameters is incorporated into a pandas expression and evaluated in a Pyodide runtime. Risk exists when an authenticated user can create or modify chatflows and subsequently cause the affected flow to execute.
The vulnerability occurs in Flowise deployments using the CSVAgent node, where the custom CSV-reading function supplied through Additional Parameters is incorporated into a pandas expression and evaluated in a Pyodide runtime. Risk exists when an authenticated user can create or modify chatflows and subsequently cause the affected flow to execute.
Exploit preconditions
- Attack surface: Flowise chatflow configuration and prediction APIs
- Required access: Authenticated permission to create or modify a chatflow
- Trigger point: Execution of a configured CSVAgent flow through its prediction endpoint
- Why exploitation is possible: User-controlled code reaches an evaluated Pyodide context, while denylist filtering does not comprehensively prevent dangerous deserialization behavior
- Attack surface: Flowise chatflow configuration and prediction APIs
- Required access: Authenticated permission to create or modify a chatflow
- Trigger point: Execution of a configured CSVAgent flow through its prediction endpoint
- Why exploitation is possible: User-controlled code reaches an evaluated Pyodide context, while denylist filtering does not comprehensively prevent dangerous deserialization behavior
Why this happens
The underlying bug is the evaluation of user-controlled CSV-processing expressions in a runtime capable of executing Python behavior. The defensive denylist focuses on selected dangerous words or constructs rather than enforcing a restricted operation set, allowing an alternate pandas deserialization path to bypass those checks. This maps to CWE-94, Improper Control of Generation of Code, because untrusted input influences executable code semantics.
The underlying bug is the evaluation of user-controlled CSV-processing expressions in a runtime capable of executing Python behavior. The defensive denylist focuses on selected dangerous words or constructs rather than enforcing a restricted operation set, allowing an alternate pandas deserialization path to bypass those checks. This maps to CWE-94, Improper Control of Generation of Code, because untrusted input influences executable code semantics.
Potential impact
- An attacker may execute arbitrary commands within the Flowise service context
- Application data and configured chatflows could be modified or exposed
- Service credentials or connected data sources could be accessed
- The host or surrounding environment could be affected depending on process privileges
- The vulnerable flow could be used to facilitate lateral movement or persistence
- An attacker may execute arbitrary commands within the Flowise service context
- Application data and configured chatflows could be modified or exposed
- Service credentials or connected data sources could be accessed
- The host or surrounding environment could be affected depending on process privileges
- The vulnerable flow could be used to facilitate lateral movement or persistence
General mitigation guidance
Mitigation generally focuses on removing executable behavior from user-defined
CSV processing and treating chatflow configuration as untrusted input.
Common defensive patterns include:
- Replace dynamic expression evaluation with a fixed allowlist of supported CSV operations
- Reject arbitrary Python expressions and unsafe deserialization formats
- Use data-only parsers and disable pickle-based loading for user-controlled content
- Apply strict schema validation and canonicalization before configuration is stored or executed
- Separate flow-editing permissions from execution permissions and enforce least privilege
- Run processing workers with minimal filesystem, network, and operating-system privileges
- Isolate user-supplied processing in constrained sandboxes with appropriate resource limits
Mitigation generally focuses on removing executable behavior from user-defined
CSV processing and treating chatflow configuration as untrusted input.
Common defensive patterns include:
- Replace dynamic expression evaluation with a fixed allowlist of supported CSV operations
- Reject arbitrary Python expressions and unsafe deserialization formats
- Use data-only parsers and disable pickle-based loading for user-controlled content
- Apply strict schema validation and canonicalization before configuration is stored or executed
- Separate flow-editing permissions from execution permissions and enforce least privilege
- Run processing workers with minimal filesystem, network, and operating-system privileges
- Isolate user-supplied processing in constrained sandboxes with appropriate resource limits
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis rules for dynamic evaluation, Pyodide execution, and unsafe deserialization APIs
- Code review checks for denylist-based validation of executable input
- Searches for user-controlled values incorporated into Python, JavaScript, or expression evaluators
- Monitoring for unexpected chatflow changes and unusual prediction requests
- Policy enforcement that blocks pickle loading and arbitrary code execution in application services
- Automated security review tools that flag tainted data reaching interpreters or deserializers
Organizations can identify similar issues through:
- Static analysis rules for dynamic evaluation, Pyodide execution, and unsafe deserialization APIs
- Code review checks for denylist-based validation of executable input
- Searches for user-controlled values incorporated into Python, JavaScript, or expression evaluators
- Monitoring for unexpected chatflow changes and unusual prediction requests
- Policy enforcement that blocks pickle loading and arbitrary code execution in application services
- Automated security review tools that flag tainted data reaching interpreters or deserializers
