Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-69255: Flowise CSV Agent RCE via Pyodide code injection, verified root shell

AIR-2026-0171 AIR record · 2026-07-flowise-csv-agent-pyodide-rce
Open in dashboard About
From the supporting source
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verifiedgithub.com
The record
Disclosed
2026-07-29
Vendor
FlowiseAI
Product
Flowise / flowise-components
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the CSV agent generated and executed Python from the uploaded file
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Uploaded csv file content
Impact type
Remote code execution, Full host compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
flowise and flowise-components <= 3.1.2
Capability abused
code_generation_from_user_datapython_sandbox_execution
Defense & remediation
Recorded defense
Pyodide WebAssembly Python sandbox
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Flowise 3.1.3
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)CVE-2026-69255code_injectionsandbox_escapepyodide_bridgetemplate_literal_interpolationfile_upload
Curator notes
GHSA-vmv7-4m6c-3cg5, CVSS 9.9 Critical, published 2026-07-29. Base64 file-upload data is interpolated into generated Python via template literals; the injected code escapes Pyodide through its JavaScript bridge using process.mainModule.constructor._load('child_process'). The advisory records that a Meterpreter reverse shell as root was established on Flowise 3.1.2. Flowise's third distinct critical RCE in the corpus after CVE-2025-59528 and CVE-2026-41265.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-69255: Flowise CSV Agent RCE via Pyodide code injection, verified root shell". AIR, AIR-2026-0171. https://agentincident.vercel.app/i/AIR-2026-0171/ (accessed 2026-10-19).