GitHub Security Advisory: GHSA-3hjv-c53m-58jj
Package: flowise (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: <= 3.0.13
Patched in: 3.1.0

Summary: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Details:
## Abstract

Trend Micro's Zero Day Initiative has identified a vulnerability affecting FlowiseAI Flowise.

## Vulnerability Details

- **Version tested:** 3.0.13
- **Installer file:** https://github.com/FlowiseAI/Flowise
- **Platform tested:** Ubuntu 25.10

## Analysis

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the `run` method of the `CSV_Agents` class. The issue results from the lack of proper sandboxing when evaluating an LLM-generated Python script. An attacker can leverage this vulnerability to execute code in the context of the user running the server.

### Product Information

FlowiseAI Flowise version 3.0.13 — https://github.com/FlowiseAI/Flowise

### Setup Instructions

```bash
npm install -g flowise@3.0.13
npx flowise start
```

### Root Cause Analysis

FlowiseAI Flowise is an open source low-code tool for developers to build customized large language model (LLM) applications and AI agents. It supports integration with various LLMs, data sources, and tools in order to facilitate rapid development and deployment of AI solutions. Flowise offers a web interface with a drag-and-drop editor, as well as an API, through an Express web server accessible over HTTP on port 3000/TCP.

One such feature of Flowise is the ability to create chatflows. Chatflows use a drag-and-drop editor that allows a developer to place nodes which control how an interaction with an LLM will occur. One such node is the CSV Agent node that represents an Agent used to answer queries on a provided CSV file.

When a user makes a query against a chatflow using the CSV Agent node, the `run` method of the `CSV_Agents` class is called. This method first reads the contents of the CSV file passed to the node and converts it to a base64 string. It then sets up a pyodide environment and creates a Python script to be executed in this environment. This Python script uses pandas to extract the column names and their types from the provided CSV file. The method then creates a system prompt for an LLM using this data as follows:

```
You are working with a pandas dataframe in Python. The name of the dataframe is df.

The columns and data types of a dataframe are given below as a Python dictionary with keys showing column names and values showing the data types.
{dict}

I will ask question, and you will output the Python code using pandas dataframe to answer my question. Do not provide any explanations. Do not respond with anything except the output of the code.

Security: Output ONLY pandas/numpy operations on the dataframe (df). Do not use import, exec, eval, open, os, subprocess, or any other system or file operations. The code will be validated and rejected if it contains such constructs.

Question: {question}
Output Code:
```

Where `{dict}` is the extracted column names and `{question}` is the initial prompt pro