CVE-2026-69264: Flowise RCE via CSVAgent data URI Python interpolation

# CVE-2026-69264: Flowise RCE via CSVAgent data URI Python interpolation

https://gcdradar.vercel.app/incidents/cve-2026-69264-flowise-rce-via-csvagent-data-uri-python-inte · AIR-2026-0895 · closed 2026-08-04

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-08-04
- AI role: Attack on AI
- Products: Flowise, CSVAgent
- CVE ids: CVE-2026-69264
- CVSS: 9.4

## Summary

Flowise contains a remote code execution vulnerability in CSVAgent where crafted data URIs interpolate into Python templates executed by Pyodide. The flaw allows attackers to break out of string literals and execute arbitrary system commands.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-08-04: CVE-2026-69264: Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python… (https://nvd.nist.gov/vuln/detail/CVE-2026-69264)
- 2026-08-04: CVE-2026-69264: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation (https://github.com/advisories/GHSA-4j8x-x6v7-w9rq)

## Sources

- 2026-08-04 GitHub Advisory Database: CVE-2026-69264: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation https://github.com/advisories/GHSA-4j8x-x6v7-w9rq
- 2026-08-04 NVD: CVE-2026-69264: Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python… https://nvd.nist.gov/vuln/detail/CVE-2026-69264

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.