THREAT OPS › Threat News › [GHSA] GHSA-4j8x-x6v7-w9rq (critical) — Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
[GHSA] GHSA-4j8x-x6v7-w9rq (critical) — Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
GHSA-4j8x-x6v7-w9rq Severity: critical CVE: CVE-2026-69264
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
### Summary Flowise's `CSVAgent` interpolates an attacker-controlled segment of the `csvFile` data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default `js
MITRE ATT&CK techniques
Indicators of compromise
- a3ffe6611b0986d646b9cd8bb8787d4fdcf9be6dsha1
- CVE-2026-69264cve
- https://target/api/v1/chatflowsurl
- https://target/api/v1/prediction/url
Original source: https://github.com/advisories/GHSA-4j8x-x6v7-w9rq