Summary
A critical prompt-injection vulnerability in Flowise can cause a CSV Agent chatflow to generate Python code that bypasses blocklist validation and execute it in an unsandboxed Pyodide environment. An attacker who can submit input to an affected chatflow may achieve arbitrary code execution with the privileges of the Flowise service account.
A critical prompt-injection vulnerability in Flowise can cause a CSV Agent chatflow to generate Python code that bypasses blocklist validation and execute it in an unsandboxed Pyodide environment. An attacker who can submit input to an affected chatflow may achieve arbitrary code execution with the privileges of the Flowise service account.
Affected context
The issue affects Flowise deployments using a CSV Agent node in a chatflow where untrusted user input is incorporated into an LLM prompt and the generated Python code is subsequently executed. Risk is increased when the Pyodide environment is unsandboxed, validation relies on blocklists, and the service account has access to sensitive data or operational capabilities.
The issue affects Flowise deployments using a CSV Agent node in a chatflow where untrusted user input is incorporated into an LLM prompt and the generated Python code is subsequently executed. Risk is increased when the Pyodide environment is unsandboxed, validation relies on blocklists, and the service account has access to sensitive data or operational capabilities.
Exploit preconditions
- Attack surface: A Flowise chatflow exposed through a user-accessible chat or API interface
- Required access: Ability to submit prompt or chat input to a flow containing the vulnerable CSV Agent functionality
- Trigger point: Processing of the CSV Agent's generated Python code before execution
- Why exploitation is possible: LLM-generated code is derived from untrusted input, while blocklist-based validation may fail to identify harmful Python behavior and the runtime is not sufficiently sandboxed
- Attack surface: A Flowise chatflow exposed through a user-accessible chat or API interface
- Required access: Ability to submit prompt or chat input to a flow containing the vulnerable CSV Agent functionality
- Trigger point: Processing of the CSV Agent's generated Python code before execution
- Why exploitation is possible: LLM-generated code is derived from untrusted input, while blocklist-based validation may fail to identify harmful Python behavior and the runtime is not sufficiently sandboxed
Why this happens
The vulnerability results from treating LLM-generated Python code as executable logic after incorporating untrusted data into the prompt. The CSV_Agents run path validates the resulting code with a blocklist-oriented check that can be bypassed, then executes it in an unsandboxed Pyodide environment. This maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced input can affect code generation and execution without a sufficiently reliable safety boundary.
The vulnerability results from treating LLM-generated Python code as executable logic after incorporating untrusted data into the prompt. The CSV_Agents run path validates the resulting code with a blocklist-oriented check that can be bypassed, then executes it in an unsandboxed Pyodide environment. This maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced input can affect code generation and execution without a sufficiently reliable safety boundary.
Potential impact
- Arbitrary code execution in the Flowise service context
- Access to data available to the service account
- Modification or deletion of accessible files and resources
- Disclosure of environment variables, credentials, or application data
- Further compromise of connected services or infrastructure
- Arbitrary code execution in the Flowise service context
- Access to data available to the service account
- Modification or deletion of accessible files and resources
- Disclosure of environment variables, credentials, or application data
- Further compromise of connected services or infrastructure
General mitigation guidance
Mitigation generally focuses on preventing untrusted prompts from controlling executable code and eliminating reliance on blocklists as the primary security boundary.
Common defensive patterns include:
- Avoiding execution of LLM-generated code whenever a non-code alternative is practical
- Replacing blocklists with narrowly scoped allowlists, structured operations, and constrained execution interfaces
- Running data-processing logic in a strongly isolated sandbox with restricted filesystem, network, and host access
- Applying least privilege to the Flowise service account and separating chatflow execution identities from administrative identities
- Treating user prompts, retrieved content, and CSV data as untrusted inputs
- Enforcing resource limits, output validation, and explicit authorization before sensitive operations
- Monitoring and restricting outbound connectivity from code-execution environments
Mitigation generally focuses on preventing untrusted prompts from controlling executable code and eliminating reliance on blocklists as the primary security boundary.
Common defensive patterns include:
- Avoiding execution of LLM-generated code whenever a non-code alternative is practical
- Replacing blocklists with narrowly scoped allowlists, structured operations, and constrained execution interfaces
- Running data-processing logic in a strongly isolated sandbox with restricted filesystem, network, and host access
- Applying least privilege to the Flowise service account and separating chatflow execution identities from administrative identities
- Treating user prompts, retrieved content, and CSV data as untrusted inputs
- Enforcing resource limits, output validation, and explicit authorization before sensitive operations
- Monitoring and restricting outbound connectivity from code-execution environments
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving dynamic Python execution, generated-code execution, or weak blocklist validation
- Code review signals where LLM output is passed directly to an interpreter or runtime
- Chatflow configurations that expose CSV Agent nodes to untrusted users
- Runtime telemetry showing unexpected interpreter activity, filesystem access, network connections, or service-account API calls
- Policy checks requiring sandbox isolation and least-privilege identities for any user-influenced code execution
- Automated security review tools that flag prompt-to-code execution paths and missing trust-boundary checks
Organizations can look for:
- Static analysis findings involving dynamic Python execution, generated-code execution, or weak blocklist validation
- Code review signals where LLM output is passed directly to an interpreter or runtime
- Chatflow configurations that expose CSV Agent nodes to untrusted users
- Runtime telemetry showing unexpected interpreter activity, filesystem access, network connections, or service-account API calls
- Policy checks requiring sandbox isolation and least-privilege identities for any user-influenced code execution
- Automated security review tools that flag prompt-to-code execution paths and missing trust-boundary checks
