GHSA-vmv7-4m6c-3cg5: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Summary

A report on GHSA-vmv7-4m6c-3cg5 describes a remote code execution flaw in Flowise, verified as root on version 3.1.2. Unsanitized base64 data from a CSV data URI is interpolated into Python code run by Pyodide in CSVAgent.ts (line 161), letting an attacker reach the host Node.js process through the js bridge and run OS commands as root in the container. The report also lists credential exposure via FLOWISE_PASSWORD and an arbitrary file read, with a CVSS v3.1 score of 9.9.

Mitigation

Option 1 (Best): Use pyodide.globals.set('base64_string', base64String) instead of string interpolation. Option 2: Validate base64 before interpolation, rejecting input that does not match /^[A-Za-z0-9+/=]*$/. Option 3: Escape special characters (", \n, \r, \\) before interpolation.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Coverage

News, research and other items that mention CVE-2026-69255.

• Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsThe Hacker News · 2026-10-15

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online