2026-04-21 · 2026-Q2
Flowise CSV Agent Prompt Injection RCE (CVE-2026-41264)
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
FlowiseAI Flowise (all versions before 3.1.0)
Impact
Authenticated RCE on Flowise hosts through any chatflow that uses the CSV Agent node; an attacker prompts the LLM into emitting a Python script that the server then runs without sandboxing
Root cause
`run` method of the CSV_Agents class evaluates LLM-generated Python without proper sandboxing; bypasses earlier hardening for CVE-2026-41137; reported through Trend Micro Zero Day Initiative; fix in 3.1.0 disallows all imports inside CSV Agent
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Flowise CSV Agent Prompt Injection RCE (CVE-2026-41264) (2026-04-21). https://agentprov.com/incidents/2026-04-21-flowise-csv-agent-prompt-injection-rce-cve-2026-41264
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config