Summary
A critical code injection vulnerability in Flowise CSVAgent allows attacker-controlled CSV data URI content to influence Python and JavaScript execution through Pyodide. A user with permission to create or update chatflows can plant a malicious CSV Agent, and an unauthenticated request to the exposed flow may then result in arbitrary file or OS command execution as the Flowise process.
A critical code injection vulnerability in Flowise CSVAgent allows attacker-controlled CSV data URI content to influence Python and JavaScript execution through Pyodide. A user with permission to create or update chatflows can plant a malicious CSV Agent, and an unauthenticated request to the exposed flow may then result in arbitrary file or OS command execution as the Flowise process.
Affected context
The vulnerability occurs in Flowise CSVAgent processing before the relevant validation routines are applied to the bootstrap code template. It affects deployments where a workspace user can create or modify chatflows or agentflows and where a crafted flow is subsequently exposed through the prediction API. Risk is increased when the Flowise process has broad filesystem, process, network, or host permissions.
The vulnerability occurs in Flowise CSVAgent processing before the relevant validation routines are applied to the bootstrap code template. It affects deployments where a workspace user can create or modify chatflows or agentflows and where a crafted flow is subsequently exposed through the prediction API. Risk is increased when the Flowise process has broad filesystem, process, network, or host permissions.
Exploit preconditions
- Attack surface: Flowise CSVAgent configuration and the exposed chatflow prediction endpoint
- Required access: Permission to create or update a chatflow or agentflow
- Trigger point: Execution of the affected flow after a request reaches its prediction endpoint
- Why exploitation is possible: Attacker-controlled data is interpolated into executable source templates, while validation does not cover the bootstrap template and the runtime exposes JavaScript capabilities through the Pyodide bridge
- Attack surface: Flowise CSVAgent configuration and the exposed chatflow prediction endpoint
- Required access: Permission to create or update a chatflow or agentflow
- Trigger point: Execution of the affected flow after a request reaches its prediction endpoint
- Why exploitation is possible: Attacker-controlled data is interpolated into executable source templates, while validation does not cover the bootstrap template and the runtime exposes JavaScript capabilities through the Pyodide bridge
Why this happens
The underlying bug is an unsafe code-generation pattern in which attacker-controlled data is inserted directly into Python source code that is later executed. The execution environment also provides a JavaScript bridge capable of reaching dynamic runtime functionality, expanding the consequences beyond the intended CSV parsing operation. This maps primarily to CWE-94: Improper Control of Generation of Code, with CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code also relevant.
The underlying bug is an unsafe code-generation pattern in which attacker-controlled data is inserted directly into Python source code that is later executed. The execution environment also provides a JavaScript bridge capable of reaching dynamic runtime functionality, expanding the consequences beyond the intended CSV parsing operation. This maps primarily to CWE-94: Improper Control of Generation of Code, with CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code also relevant.
Potential impact
- An attacker may execute arbitrary OS commands as the Flowise process
- Sensitive files may be read, modified, or deleted
- Application secrets and environment data could be exposed
- The Flowise host or container could be compromised
- The attacker could modify workflows or use the process for lateral movement
- An attacker may execute arbitrary OS commands as the Flowise process
- Sensitive files may be read, modified, or deleted
- Application secrets and environment data could be exposed
- The Flowise host or container could be compromised
- The attacker could modify workflows or use the process for lateral movement
General mitigation guidance
Mitigation focuses on eliminating dynamic execution of data-derived source code and reducing the privileges available to workflow components.
Common defensive patterns include:
- Treating CSV data URIs and related configuration values strictly as data, not source-code fragments
- Using parameterized APIs or dedicated CSV parsers instead of generated Python or JavaScript
- Applying validation and encoding before every template construction and execution boundary
- Removing unnecessary JavaScript bridges, dynamic imports, and evaluation capabilities from embedded runtimes
- Enforcing strict allowlists for workflow configuration and limiting who can publish executable flows
- Running Flowise with least-privilege filesystem, process, network, and container permissions
- Isolating code-executing workers from sensitive host and application resources
Mitigation focuses on eliminating dynamic execution of data-derived source code and reducing the privileges available to workflow components.
Common defensive patterns include:
- Treating CSV data URIs and related configuration values strictly as data, not source-code fragments
- Using parameterized APIs or dedicated CSV parsers instead of generated Python or JavaScript
- Applying validation and encoding before every template construction and execution boundary
- Removing unnecessary JavaScript bridges, dynamic imports, and evaluation capabilities from embedded runtimes
- Enforcing strict allowlists for workflow configuration and limiting who can publish executable flows
- Running Flowise with least-privilege filesystem, process, network, and container permissions
- Isolating code-executing workers from sensitive host and application resources
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving string interpolation into Python, JavaScript, or other executable templates
- Uses of evaluation, dynamic import, runtime bridges, or subprocess APIs in workflow and agent components
- Code paths where validation covers user functions but not bootstrap or wrapper templates
- Review signals showing that workspace-controlled fields can reach interpreters without a strict data-only representation
- Policy checks that restrict publication of flows containing dynamic execution or privileged runtime capabilities
- Runtime monitoring for unexpected child processes, filesystem access, imports, or commands initiated by Flowise workers
Automated code review and software composition tools may help identify these patterns when configured for dynamic code execution risks.
Organizations can look for:
- Static analysis findings involving string interpolation into Python, JavaScript, or other executable templates
- Uses of evaluation, dynamic import, runtime bridges, or subprocess APIs in workflow and agent components
- Code paths where validation covers user functions but not bootstrap or wrapper templates
- Review signals showing that workspace-controlled fields can reach interpreters without a strict data-only representation
- Policy checks that restrict publication of flows containing dynamic execution or privileged runtime capabilities
- Runtime monitoring for unexpected child processes, filesystem access, imports, or commands initiated by Flowise workers
Automated code review and software composition tools may help identify these patterns when configured for dynamic code execution risks.
