Security readout for executives and security teams
Plain-English summary
Flowise versions before 3.1.3 allow a permitted workspace user to hide malicious content inside a CSV Agent configuration. When anyone later calls the published chatflow prediction endpoint, Flowise can execute that content with the server process’s privileges, potentially exposing files, credentials, connected systems, and service availability.
Executive priority
Treat this as an immediate patching and access-review priority for affected Flowise deployments. A malicious or compromised workspace account could establish server-level code execution that is subsequently triggered without authentication. Prioritize internet-accessible prediction endpoints and environments where Flowise holds sensitive credentials or reaches critical systems.
Technical view
CSVAgent inserts an attacker-controlled csvFile data-URI segment into executable Python source without validating the bootstrap template. Pyodide’s default JavaScript bridge can expose Node.js capabilities, enabling arbitrary file access and operating-system command execution. Planting the payload requires chatflow creation or update permission; triggering an exposed flow may require no authentication.
Likely exposure
Flowise deployments below 3.1.3 are affected. Highest risk exists where untrusted or compromised workspace users can create or update chatflows and CSV Agent flows are exposed through POST /api/v1/prediction/:id. Exposure cannot be determined from version alone; permissions, flow configuration, endpoint accessibility, and prior modifications must be reviewed.
Exploitation context
The supplied sources describe a credible remote-code-execution path with low attack complexity and no user interaction after configuration. Initial placement requires limited workspace privileges, but an unauthenticated request can trigger a planted exposed flow. The CVE is not listed as KEV in the supplied bundle, and no evidence of active exploitation is provided.
Researcher notes
The vulnerable bootstrap path bypasses both named Python validators. The impact depends on Pyodide’s bridge to globalThis and Node.js dynamic imports, allowing execution in the Flowise process context. Defensive review should focus on affected versions, CSV Agent configuration history, privileged workspace activity, exposed prediction routes, and host-level indicators; the supplied evidence does not establish exploitation in the wild.
Mitigation direction
- Upgrade Flowise to version 3.1.3 or later.
- Restrict chatflow creation and update permissions to trusted administrators.
- Disable or unpublish affected CSV Agent flows until upgrading.
- Limit prediction endpoint access while investigating potentially exposed flows.
- Rotate credentials if evidence suggests the Flowise process was compromised.
Validation and detection
- Confirm every Flowise deployment reports version 3.1.3 or later.
- Inventory CSV Agent nodes and identify externally accessible prediction endpoints.
- Review workspace roles for chatflow creation or update permissions.
- Inspect recent chatflow changes for unexpected csvFile data URIs.
- Review process, file-access, and child-process telemetry for anomalous Flowise activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-95: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-69264 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4j8x-x6v7-w9rqCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/FlowiseAI/Flowise/pull/6499CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626cCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.