CVE-2026-41137
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.
Ver en NVDAnálisis
Flowise versions before 3.1.0 are vulnerable to remote code execution via the CSVAgent component. Attackers can provide malicious payloads through the custom Pandas CSV read functionality that are executed by the server, potentially leading to a full system compromise. If you are using Flowise to build LLM flows, upgrade to 3.1.0 immediately.
Severidad
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCWE-94EPSS
Afecta
flowiseai:flowiseDescripción técnica
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.