Validated Research Published: Aug 24, 2026

Flowise CSV Agent: Prompt Injection Bypasses a Regex Blocklist and Reaches Host-Capable Pyodide

CVE-2026-70477 affects Flowise and flowise-components through 3.1.2 and is fixed in 3.1.3. In the disclosed prompt-injection path, an unauthenticated attacker sends instructions to a chatflow containing a CSV Agent. The LLM returns obfuscated Python, the static regex blocklist accepts it, and Flowise passes the code to Pyodide. Because that runtime was not isolated from host operating-system interfaces, the payload executes with the privileges of the user running the server.

Prompt InjectionRemote Code ExecutionInput ValidationRuntime IsolationAgentic AI
5 applicable AIDEFEND defenses
Source: CSV Agent Prompt Injection Remote Code Execution Vulnerability (GHSA-5xvg-pmgg-3mxr) 
Authors: Dre Cura, TrendAI Research
Original article: Jul 29, 2026

Threat Analysis

  • The security decision was made with a bypassable regex blocklist. The advisory demonstrates eight variants, including string concatenation, chr() encoding, builtin aliasing, frame inspection, MRO traversal, df.query(), and decorator-based indirect execution. This is not an AST-validation or template-interpolation flaw.
  • The model output crossed directly into a code-execution sink. Flowise removed code fences, called validatePythonCodeForDataFrame(), prefixed pandas and NumPy imports, and then invoked pyodide.runPythonAsync(). A prompt became executable Python after a single denylist decision.
  • Pyodide was not the containment boundary the application needed. The advisory states that code which passed validation retained access to host OS interfaces and ran in the context of the user operating the Flowise server.
  • The demonstrated route is conditional. It requires a reachable chatflow using the affected CSV Agent and an LLM response that produces a working bypass; the advisory notes that prompt injection may need multiple attempts depending on the model.

Applicable AIDEFEND Defenses (5)

AID-H-025.001
Pre-Execution Static Analysis & Dangerous Construct Blocking
Very High
Replace the regex denylist with a fail-closed, signed-policy AST admission gate over the exact Python bytes immediately before execution. Block dangerous imports, indirect builtin access, command execution, and other prohibited constructs; a clean result still does not prove arbitrary code safe.
AID-H-025.002
Safe Interpreter Enforcement
Very High
Route permitted evaluations only to an explicitly allowlisted restricted interpreter selected by an execution gateway. The model must never choose or relax the interpreter profile.
AID-I-001.003
Ephemeral Single-Use Sandboxes for Tools
Very High
Run each evaluation once inside a fresh microVM, gVisor, or Kata boundary, then destroy it. Keep the Flowise host process, filesystem, credentials, and management plane outside that boundary.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Reconcile the exact deployed Flowise population against the advisory and redeploy 3.1.3 or later through a staged rollout with digest-level completion evidence.
AID-H-002.002
Inference-Time Prompt & Input Validation
Partial
Put a calibrated prompt-injection gate before the primary LLM and reject or quarantine suspicious requests before prompt assembly. This can reduce successful malicious code-generation attempts, but it is a bounded first layer and cannot replace executable-artifact admission or runtime isolation.

What Defenders Should Do Now

  • Identify Flowise and flowise-components versions and upgrade every affected deployment to 3.1.3 or later.
  • Until the rollout is complete, disable public access to chatflows that contain a CSV Agent or remove the node from untrusted workflows.
  • Add a bounded prompt-injection gate before the primary LLM, then put generated-code evaluation behind exact-byte AST admission, a restricted interpreter policy, and an independent one-shot sandbox; do not treat any one layer as sufficient.
  • Remove host credentials, writable mounts, management sockets, and unrestricted network access from the evaluation boundary.
  • Review prediction requests and execution telemetry for repeated obfuscated Python attempts, then rotate credentials if code execution cannot be excluded.

Conclusion

This case is a direct model-output-to-code-execution failure. A prompt-injection gate can reject some malicious requests early, but the complete executable artifact must still face a strong pre-execution gate, a restricted interpreter, and an independent runtime containment boundary. Flowise 3.1.3 closes the disclosed path, while those layers reduce the impact of the next validator bypass.