CVE-2026-70477: 
JavaScript vulnerability analysis and mitigation

CVE-2026-70477 is a prompt injection-driven remote code execution (RCE) vulnerability in FlowiseAI Flowise, a drag-and-drop LLM workflow builder. Discovered by Dre Cura of TrendAI Research (Trend Micro's Zero Day Initiative, ZDI-CAN-30459) and published on July 29, 2026, it affects the flowise and flowise-components npm packages at versions ≤ 3.1.2. The flaw allows an unauthenticated remote attacker to execute arbitrary code on the server by injecting a malicious prompt into a chatflow using the CSV Agent node. It carries a CVSS v4.0 base score of 9.5 (Critical) (Github Advisory, Flowise Security Advisory).

The root cause is improper control of code generation (CWE-94): user-controlled input is substituted directly into an LLM system prompt within the run method of the CSV_Agents class (packages/components/nodes/agents/CSVAgent/CSVAgent.ts). The LLM's response (pythonCode) is then validated by validatePythonCodeForDataFrame — a static regex blocklist in pythonCodeValidator.ts — before being executed via pyodide.runPythonAsync(). Because pyodide runs unsandboxed with full access to host OS interfaces, any payload that bypasses the blocklist achieves arbitrary OS-level code execution. At least eight distinct bypass techniques were demonstrated, including @exec decorator with string-concatenated __import__, chr()-encoded payloads, MRO traversal, generator frame inspection, and df.query() expression evaluation — all of which evade the regex patterns (Github Advisory, Flowise Security Advisory).

Successful exploitation grants an attacker arbitrary code execution in the context of the Flowise service account, with full access to the host operating system's interfaces via the unsandboxed pyodide environment. This results in complete compromise of confidentiality, integrity, and availability of the vulnerable system and any subsequent systems reachable from it. An attacker could exfiltrate sensitive data (including LLM API keys, database credentials, and user data stored by Flowise), modify or destroy application data, establish persistent backdoors, or pivot laterally within the hosting environment (Github Advisory, Flowise Security Advisory).

A proof-of-concept (poc.py) with three operational modes (malicious server, chatflow creation, and direct prompt injection) was developed by the ZDI researcher and is referenced in the advisory, confirming public PoC availability. The NVD SSVC assessment classifies exploitation as "poc" with "yes" for automatable and "total" for technical impact. No authentication is required for the prompt injection attack vector; an authenticated variant also exists where an attacker configures a chatflow pointing to an attacker-controlled LLM server. The EPSS score is approximately 0.44% (37th percentile). There is no current CISA KEV catalog listing, and no confirmed in-the-wild exploitation has been reported (Github Advisory, Flowise Security Advisory).

1. Reconnaissance: Identify internet-facing Flowise instances (versions ≤ 3.1.2) using tools like Shodan or Censys, searching for the Flowise web UI or API endpoints. Confirm the presence of a chatflow using the CSV Agent node by querying the prediction API.
2. Craft prompt injection payload: Prepare a prompt injection string designed to instruct the LLM to output a malicious Python script. Use one of the eight documented bypass techniques (e.g., @exec decorator with string-concatenated __import__, or chr()-encoded payloads) to evade the validatePythonCodeForDataFrame regex blocklist.
3. Send malicious request: Submit the crafted prompt to the chatflow's prediction endpoint (e.g., POST /api/v1/prediction/<chatflow_id>) with the injection payload in the question field. Due to LLM non-determinism, multiple attempts or different injection techniques may be needed.
4. Trigger code execution: The LLM responds with the attacker-crafted Python code, which passes the blocklist validator. Flowise executes it via pyodide.runPythonAsync() in an unsandboxed environment with full OS access.
5. Achieve objective: The executed Python code runs OS commands (e.g., reverse shell, data exfiltration, credential harvesting) as the Flowise service account. Alternatively, an authenticated attacker can configure a chatflow to use an attacker-controlled LLM server that directly returns the malicious payload, bypassing the LLM step entirely (Github Advisory, Flowise Security Advisory).

• Network: Unusual outbound connections from the Flowise server process to unknown external IPs or attacker-controlled hosts; unexpected DNS lookups or HTTP requests originating from the Node.js/pyodide process; POST requests to /api/v1/prediction/<chatflow_id> containing obfuscated Python constructs (e.g., chr(), __getattribute__, gi_frame, f_builtins, __subclasses__) in the question field.
• Process: Unexpected child processes spawned by the Flowise Node.js process (e.g., /bin/bash, sh, curl, wget, python3, nc); unusual process trees originating from the service account running Flowise.
• File System: New or modified files in the Flowise installation directory or temp directories; unexpected cron jobs, systemd units, or startup scripts created by the Flowise service account; web shells or reverse shell scripts dropped to disk.
• Logs: Flowise application logs showing repeated or unusual prediction API calls with long or obfuscated question fields; Python execution errors referencing pyodide.runPythonAsync with unexpected code; log entries showing Generated code was rejected for security reasons followed by successful execution attempts with different payloads.

The vendor's fix in version 3.1.3 removes the CSV Agent and Airtable Agent components entirely, along with the pythonCodeValidator.ts and the pyodide dependency, eliminating the vulnerable code path (PR #6499, commit f4e2794) (Flowise Release, Fix PR). Immediate action: Upgrade both flowise and flowise-components npm packages to version 3.1.3 or later. If upgrading is not immediately possible, restrict network access to the Flowise prediction API endpoints and disable or remove any chatflows using the CSV Agent node as a temporary workaround. There is no configuration-based mitigation that fully addresses the blocklist bypass without removing the feature.

The vulnerability was discovered and reported by Dre Cura (@dre_cura) of TrendAI Research (Trend Micro's Zero Day Initiative), which coordinated disclosure with FlowiseAI. The advisory notes that the Flowise GitHub repository was archived by the owner on August 13, 2026, shortly after the public disclosure, which may indicate a broader product lifecycle decision. Community tracking tools including VulnDB, OSV, and GitLab Advisories indexed the vulnerability promptly after publication. A blog post titled "How to Close the Flowise CSV Agent Prompt Injection Hole" was published on dev.to and vinpatel.com, indicating practitioner-level community interest in remediation guidance (Github Advisory).