What is CVE-2026-69255?
CVE-2026-69255 is a code execution vulnerability in Flowise where attacker-supplied CSV data via the CSVAgent is unsafely extracted using `file.split(',').pop()` and directly interpolated into executable Python code. This affects Flowise versions prior to 3.1.3, and users should immediately upgrade to the patched version.
Azərbaycanca: Flowise LLM inteqrasiya platformasında aşkar edilmiş CVE-2026-69255, CSVAgent vasitəsilə təqdim olunan zərərli CSV fayllarındakı məlumatların Python koduna birbaşa daxil edilməsi nəticəsində kod icrası (code execution) zəifliyinə səbəb olur. Bu boşluq 3.1.3 versiyasından əvvəlki versiyalara təsir edir və istifadəçilərə dərhal yeniləmə tətbiq etmələri tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
Which component of the Flowise platform is exploited by CVE-2026-69255?
This vulnerability is exploited through the CSVAgent component of Flowise, where data from the malicious CSV file is extracted using `file.split(',').pop()` and directly interpolated into Python code.
What measure should be taken to protect against the CVE-2026-69255 code execution vulnerability?
Users should immediately upgrade to Flowise version 3.1.3 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.