FlowiseAI CSV Agent prompt-injection RCE via unsandboxed Python eval

CVE-2026-41264 is a prompt-injection remote code execution flaw in FlowiseAI Flowise, the drag-and-drop LLM application builder. See also the AI tools security topic hub for related coverage. Per NVD, the CSV Agent node evaluates LLM-generated Python without sandboxing. A CSV crafted to prompt-inject the underlying model can therefore produce Python that runs as the Flowise server process. All versions prior to 3.1.0 are affected.

Advisory context

Discovery is credited to Takahiro Yokoyama and coordinated through the Zero Day Initiative. Vendor advisory: GHSA-3hjv-c53m-58jj. NVD record published 2026-04-23. Rapid7 shipped a public Metasploit module targeting the flaw on 2026-07-10 — module path multi/http/flowise_auth_rce_cve_2026_41264, which uses an API key holding chatflows:create as its ingress. The underlying flaw does not require Flowise authentication to trigger; the module’s precondition is a scope choice, not a limitation of the vulnerability.

Who is exposed?

Self-hosted Flowise instances on any version prior to 3.1.0 are the affected surface. Exposure varies by deployment configuration:

• No API key required: A Flowise instance reachable without authentication has the widest surface. Network access alone is sufficient to reach the CSV Agent node.
• API key with chatflows:create: Any key scoped to chatflow creation covers the vulnerable path. Developer integrations, CI automation tokens, and internal tool API keys are common holders of this scope.
• Authenticated users with CSV upload access: Anyone who can interact with the Flowise UI on a pre-3.1.0 build and upload a CSV can trigger the flaw.

Containerized and cloud-hosted deployments are not inherently safer unless the running image is pinned at 3.1.0 or later. Flowise instances frequently get spun up quickly in developer environments and internal tooling, outside the normal asset-management and patch-cadence process. That gap is where this CVE tends to live.

What does exploitation look like?

CVE-2026-41264 is a prompt-injection path to code execution. The attacker crafts a CSV whose contents instruct the connected language model to generate Python code rather than answer a question. Because the CSV Agent node evaluates that LLM output directly, without sandboxing, the generated code runs in the context of the Flowise server process, with its privileges and network access.

This is not a memory-corruption flaw or an authorization bypass in the conventional sense. The vulnerability is an architectural decision: the CSV Agent was built to let the LLM produce and run code. The missing control is a boundary between what the model outputs and what the interpreter executes. A hostile CSV removes that boundary by manipulating the model’s behavior.

No Flowise authentication is required at the vulnerability level. The class of impact is arbitrary code execution as the server process.

Timeline

• 2026-04-23: NVD record published. Flowise 3.1.0, which removes the unsandboxed eval path from the CSV Agent node, is the confirmed fixed release.
• 2026-07-10: Rapid7 publishes Rapid7’s Metasploit module for CVE-2026-41264, making the flaw a repeatable step in engagements and materially raising practical exploitation risk.

What to do

Upgrade Flowise to 3.1.0 or later. Inventory any API keys issued against a Flowise instance and their permission scopes — a key with chatflows:create on any pre-3.1.0 build is now a Metasploit target. If the instance is reachable without an API key, the exposure is wider than the module’s default path suggests.

Frequently asked questions

What is CVE-2026-41264?

CVE-2026-41264 is a critical remote-code-execution vulnerability in FlowiseAI’s CSV Agent node. A hostile CSV can influence the connected language model into producing Python that an affected Flowise server evaluates without an adequate sandbox.

Is CVE-2026-41264 actively exploited?

A public Metasploit module makes the vulnerability weaponized and materially raises exploitation risk. That does not by itself prove widespread attacks in the wild. Defenders should treat exposed, pre-3.1.0 instances as urgent patch targets and review their logs for unexpected chatflow creation or server-side process activity.

How do I fix CVE-2026-41264?

Upgrade to Flowise 3.1.0 or newer, restrict network access to the service, and rotate API keys that could have reached an affected instance. Review keys with chatflows:create first, then investigate any unexplained flows or child processes before returning the service to wider access.

Is CVE-2026-41264 in CISA KEV?

No. CVE-2026-41264 is not on CISA’s Known Exploited Vulnerabilities catalog as of October 1, 2026. Its status is patched, not KEV-designated. The presence of a public Metasploit module (available since July 10, 2026) means practical exploitation risk is elevated regardless of KEV designation. Organizations running self-hosted Flowise prior to 3.1.0 should treat it as a priority patch independent of any KEV listing.

Is Flowise SaaS or cloud-hosted affected?

The vulnerability is in self-hosted Flowise instances prior to 3.1.0. Flowise does not currently operate a managed cloud service; all deployments are operator-run. “Cloud-hosted” instances (e.g., Flowise running on AWS, GCP, or Azure in a customer-managed container) are affected if the running image is prior to 3.1.0. The cloud provider’s infrastructure is not at risk. Only the Flowise process itself is the attack surface.

Which versions of Flowise are affected by CVE-2026-41264?

All Flowise releases prior to version 3.1.0 are affected. Version 3.1.0 removes the unsandboxed Python eval path from the CSV Agent node and is the fixed release. Deployments running any earlier version, including containerized or cloud-hosted instances running a pre-3.1.0 image, remain vulnerable.

What is the CVSS score for CVE-2026-41264?

The CVSS v3.1 score is 9.8, Critical. The score reflects remote reachability and the potential loss of confidentiality, integrity and availability when generated code executes in the Flowise server context.

Coverage context and the two-abstraction framing alongside the macOS PackageKit LPE shipped in the same wrap-up: Metasploit Weekly Adds Flowise CSV, macOS PackageKit. Canonical NVD record: CVE-2026-41264.