CVE-2026-73486CWE-94code-injection

CVE-2026-73486

High · published August 13, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00662 · 51.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-13T16:17Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise< 3.1.33.1.3
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4878-cqgq-j53v · [email protected]https://www.vulncheck.com/advisories/flowise-before-code-injection-via-csv-agent-customreadcsv · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4878-cqgq-j53v · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 11:28Z
    Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV
    cvelistv5