FlowiseAI: RCE in CSV Agent, Authentication Bypassable

On June 24, 2026, TrendAI publicly disclosed advisory ZDI-26-365 for a vulnerability in the CSV Agent component of FlowiseAI, a low-code platform for orchestrating workflows with language models. The flaw, discovered on February 24, 2026, by Nicholas Zubrisky of TrendAI Research, allows remote execution of arbitrary Python code through the customReadCSV parameter, with bypassable authentication. The incident highlights a recurring pattern in AI platforms: the abstraction that simplifies LLM use conceals the unsafe execution of dynamic code.

The Mechanism: From CSV Wrapper to Arbitrary Exec

FlowiseAI's CSV Agent component processes CSV files by executing dynamic Python code. According to advisory ZDI-26-365, "the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code." The customReadCSV parameter allows users to supply a custom string that is inserted directly into Python execution without sufficient sanitization.

The patch commit on GitHub, identified by pull request #5836, confirms the fix architecture. The code adds const csvReadValidation = validatePythonCodeForDataFrame(customReadCSVFunc) with a conditional block that halts execution if validation fails. The rejection message is explicit: "Custom read_csv code was rejected for security reasons. Please use only safe pandas read_csv operations."

Bypassable Authentication: The Double Track of Security

The advisory specifies that "authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed." This configuration creates a particular risk condition: authentication is formally present but operationally ineffective. The dossier does not detail the exact bypass technique, limiting the ability to assess attack complexity.

The operational context amplifies the problem. FlowiseAI is often deployed with access to API keys, database connections, and corporate filesystems. Code execution in the context of the service account, as documented by the advisory, opens the door to data exfiltration, lateral movement, and compromise of the orchestrated infrastructure.

The Patch and Its Limits: Syntactic Validation vs. Architectural Hardening

FlowiseAI's fix focuses on validating Python code before execution. The validatePythonCodeForDataFrame function represents a syntactic sanitization approach: it analyzes user-supplied code and blocks it if it contains constructs not deemed safe for safe for safe pandas read_csv operations. However, the partial diff available does not allow evaluation of this function's completeness or its resilience against evasion.

The same commit also shows a modification to secureAxiosRequest to handle non-2xx status codes, suggesting the security review touched more components of the communication system. The dossier does not specify whether this change is directly related to the vulnerability or represents a parallel intervention.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed." — ZDI Advisory ZDI-26-365

What to Do Now

Organizations using FlowiseAI must verify the presence of patch #5836 in their environment. The commit 0c8236ac on GitHub contains the validatePythonCodeForDataFrame function and the validation block on customReadCSVFunc: ensure the source code includes these elements.

Manually check the configuration of the customReadCSV parameter in all active CSV Agent workflows. If the field is populated with custom code, verify its provenance and remove any untrusted input pending patch confirmation.

Monitor execution logs for error messages containing "Custom read_csv code was rejected for security reasons": their absence indicates validation is not active or that malicious code passed through unscathed.

Assess network segmentation of FlowiseAI installations. The advisory confirms execution in the service account context: isolating the instance from sensitive databases, external APIs, and shared filesystems reduces the impact of a potential exploit.

Why It Matters

Case ZDI-26-365 illustrates a structural tension in low-code AI platforms: the abstraction that makes advanced capabilities accessible obscures the risks of dynamic code execution. Users configure visual workflows without perceiving that parameters like customReadCSV translate into Python execution in the underlying runtime.

The validation introduced by FlowiseAI resolves the immediate vector but does not address the underlying architecture. The dossier does not document whether the platform has isolated Python execution in a sandbox with reduced privileges, implemented integrity controls on flows, or hardened authentication independently of code sanitization.

Specific affected versions are not listed in the advisory, preventing organizations from quickly determining if their installations are vulnerable. No CVE is assigned in the dossier, limiting traceability in standard vulnerability management systems.

The Reading Angle: When Low-Code Becomes Opaque

The accelerated adoption of platforms like FlowiseAI in enterprise contexts demands a reassessment of risk models. The visual orchestration of LLMs, databases, and external services concentrates significant privileges in seemingly innocuous interfaces. The CSV Agent vulnerability demonstrates that every node in a workflow can hide arbitrary execution surfaces.

The open-source community's response — a patch with syntactic validation — represents standard practice but does not eliminate the risk class. As long as AI platforms execute dynamic code on potentially hostile data, the combination of weak authentication and unsanitized user parameters will constitute a systemic vector. The case calls for independent verification of the robustness of validatePythonCodeForDataFrame and its resistance to evasion techniques not yet publicly tested.

Frequently Asked Questions

What makes this vulnerability relevant for enterprise environments?

FlowiseAI is often integrated with corporate databases, external APIs, and cloud services. Remote code execution in the service context directly exposes these connections, with potential impact on the confidentiality, integrity, and availability of orchestrated data.

Why is the absence of a CVE significant?

Without a CVE identifier, automated vulnerability management systems do not detect ZDI-26-365 in standard scans. Organizations must intervene manually, causing delays in classification and prioritization of corrective actions.

Does the patch guarantee complete protection?

The dossier does not document independent security testing of the validatePythonCodeForDataFrame function or the completeness of its filtering logic. Protection depends on its actual implementation, not yet publicly verified.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-365/
• https://github.com/FlowiseAI/Flowise/commit/0c8236ac9a9720725e135603f4a54f7d7d6646ac

Information verified against cited sources and current as of publication.

Sources