Flowise: Critical RCE in CSV Agent, Component Removed from…

CVE-2026-70477 with CVSS 9.8 in Flowise's CSV_Agent component: unauthenticated prompt injection leads to remote code execution. The vendor fixed the issue by removing the component entirely.

The Zero Day Initiative published advisory ZDI-26-634 on September 9, 2026, documenting a remote code execution vulnerability in the CSV_Agent component of the low-code Flowise platform. The bug, tracked as CVE-2026-70477 with a CVSS score of 9.8 per ZDI's published listings, allows an unauthenticated remote attacker to achieve arbitrary code execution in the context of the service. The fix was not a patch: the vendor completely removed the component from the source code, along with the parallel AirtableAgent.

Key Takeaways

The vulnerability ZDI-26-634 (CVE-2026-70477, CVSS 9.8) resides in the run method of the CSV_Agents class in Flowise.
The exploit leverages insufficient input sanitization in untrusted CSV data embedded in LLM prompts, requiring no authentication.
The Flowise repository was archived by the owner on August 13, 2026; the exact date of the fix commit is not documented in the sources.

The Attack Chain: When Data Crosses the Perimeter

The vulnerability mechanism is documented in the ZDI advisory with technical precision. The flaw resides in the run method of the CSV_Agents class: user-supplied untrusted data is used to construct a Large Language Model prompt without adequate sanitization. The malicious input, inserted into a CSV file uploaded to the agent, thus crosses the boundary between external data and internal system instruction.

The consequence is arbitrary code execution in the context of the service account running Flowise. The CVSS 9.8 score — reported in ZDI's published listings for CVE-2026-70477 — reflects the combination of remote access, no authentication required, and critical impact on system confidentiality, integrity, and availability. No explicit exploit vector string emerges from the sources in the advisory text.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability." — Advisory ZDI-26-634

The Radical Fix: Why Remove Instead of Patch

The vendor's response was not a localized correction. The GitHub commit documenting the intervention states: "fix(flowise-606): remove AirtableAgent and CSVAgent due to security vulnerabilities". The operation entailed the deletion of 1,601 lines of code, equivalent to the complete removal of both agents from the codebase.

This architectural choice — eliminating an entire feature rather than securing it — is telling. It suggests the attack surface was not a circumscribed implementation error, but intrinsic to how the CSV agent interacted with the language model: any ingestion of external structured content for dynamic prompt construction exposes a trust boundary violation that point patches cannot resolve without compromising the functionality itself.

The Flowise repository was archived on August 13, 2026. The sources do not specify whether the removal commit preceded or followed this date, nor whether the archival is correlated with the vulnerability handling.

Timeline and Disclosure Coordination

The vulnerability was reported to the vendor on April 23, 2026. Coordinated publication of the advisory occurred on September 9, 2026: an interval of roughly 140 days, consistent with standard coordinated disclosure cycles for complex vulnerabilities requiring structural fixes.

No information emerges from the sources regarding potential in-the-wild exploitation, nor the identity of the researcher who discovered and reported the flaw. The official CVE Record confirms the existence of CVE-2026-70477 but adds no technical details beyond those in the ZDI advisory.

What to Do Now

Operators running Flowise in production environments must verify whether the CSVAgent or AirtableAgent components are active in their instances. The removal of the component from the source code implies that updates to versions subsequent to the fix will automatically expose the absence of the functionality; those who require CSV processing via LLM agent will need to evaluate architectural alternatives or custom components with hardened input controls.

For installations that cannot update immediately, mitigation involves explicitly disabling the affected components and restricting access to CSV upload interfaces, although the sources do not document specific hardening configurations for this vulnerability.

The absence of the CVSS vector string in the advisory text does not allow precise calculation of the risk profile for partial scenarios; the 9.8 score remains indicative of maximum remediation priority.

Frequently Asked Questions

Which Flowise versions are affected?

The sources do not specify affected versions. The ZDI advisory and CVE Record do not list affected or fixed version ranges. Users should assume any instance with the CSVAgent or AirtableAgent components present is potentially exposed.

Is a specific security update required?

The fix was implemented by removing the vulnerable code from the repository, not via an incremental patch. Anyone using custom builds or forks of the project must manually integrate the removal of the affected components.

Does the archived repository mean Flowise is no longer maintained?

The archival of the GitHub repository on August 13, 2026 indicates the owner has made the project read-only. The sources do not document maintenance transfer plans nor any causal relationship, if existent, with the vulnerability handling.

The removal of an entire component to resolve a security flaw signals that the low-code AI agent platform sector has yet to stabilize the boundaries between functionality and risk. When the only possible fix is eliminating the feature, the question is no longer technical: it is architectural, and bears on the maturity of the LLM-structured data integration model itself.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter