GHSA-3hjv-c53m-58jj: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Summary

Trend Micro's Zero Day Initiative reports an unauthenticated remote code execution flaw in FlowiseAI Flowise, tested at version 3.0.13. The flaw sits in the run method of the CSV_Agents class, which evaluates an LLM-generated Python script without proper sandboxing. The input validation that checks for forbidden patterns can be bypassed, allowing arbitrary OS commands to run on the server as the user running it.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Topics

• Prompt injection and jailbreaks

Related items

• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• LowCVE-2026-123498: Vikunja veans prompt injection through project titles and task contentSimilar attack · NVD/CVE Database
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database