# Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise CSV Agent evaluates LLM-generated Python in pyodide; a regex denylist bypass via aliased imports lets unauthenticated prompt injection run OS commands.

- Payout: Research
- Severity: critical
- Program: Flowise
- Found by: zdi-disclosures
- Disclosed: 2026-04-21
- CVE: CVE-2026-41264
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-3hjv-c53m-58jj
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-3hjv-c53m-58jj
- Tags: area:ai domain:ai domain:web impact:rce kind:research platform:ghsa sev:critical tech:llm tech:nodejs tech:python technique:source-review vuln:prompt-injection vuln:rce

**Target:** CSV Agent node in Flowise chatflow (Express server, port 3000)
**Root cause:** LLM-generated Python is executed in pyodide guarded only by a regex denylist (FORBIDDEN_PATTERNS in validatePythonCodeForDataFrame); the import regex uses a negative lookahead that is defeated by aliasing, so arbitrary modules like os load.
**Steps:**
1. Deploy flowise@3.0.13 and start with `npx flowise start`.
2. Create a chatflow containing the CSV Agent node with a CSV file.
3. Send a prompt that injects instructions so the LLM emits `import pandas as np, os as pandas` followed by `pandas.system("xcalc")`.
4. The regex `\bimport\s+(?!pandas|numpy\b)` fails to match because pandas is imported first; validatePythonCodeForDataFrame passes the script.
5. Script is evaluated in pyodide and the OS command executes on the server.
**How found:** Reviewed the CSV_Agents.run flow and the FORBIDDEN_PATTERNS regex list; noticed the import regex `\bimport\s+(?!pandas|numpy\b)` only checks the token immediately after import, so importing pandas first and aliasing os as pandas slips through.
**Exploitation:** Unauthenticated attacker sends a crafted prompt to a chatflow using the CSV Agent node, convincing the LLM to return a malicious Python script; alternatively an authenticated attacker points the chatflow at an attacker-controlled server that returns the malicious script directly. The script is evaluated in pyodide, executing attacker commands in the server user's context.
**Insight:** When a denylist regex guards code execution, test whether the pattern anchors only the first token: `import pandas as np, os as pandas` satisfies a lookahead that only inspects the first module name, and the alias then exposes os methods under an allowed name.

## Proof of concept (copied exactly from the original report)

**Bypass payload importing os aliased as pandas**

```
import pandas as np, os as pandas
pandas.system("xcalc")
```