Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM generated python script. An attacker can leverage this vulnerability to execute code in the context of the user running the server. Using prompt injection techniques, an unauthenticated attacker with the ability to send prompts to a chatflow using the CSV Agent node may convince an LLM to respond with a malicious python script that executes attacker controlled commands on the Flowise server. This vulnerability is fixed in 3.1.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlowiseAI | Flowise | < 3.1.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Flowise CSV Agent Prompt Injection RCE
exploit/multi/http/flowise_auth_rce_cve_2026_41264
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.1.0 | 3.1.0 | GHSA-3hjv-c53m-58jj |
| npm | flowise-components | < 3.1.0 | 3.1.0 | GHSA-3hjv-c53m-58jj |
Advisories 1
- WID-SEC-2026-1145 Flowise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 12, 2026