Flowise CSV Agent 提示注入致远程代码执行漏洞

1. 00:17
   GitHub 安全公告Selected

   Flowise 3.1.2's CSV/Airtable Agent validators can be bypassed, leading to data exfiltration and SSRF.

   In Flowise 3.1.2 and earlier versions, the CSV Agent and Airtable Agent nodes use regex blacklists to validate LLM-generated Python code, and there are multiple structural bypasses. Attackers can perform prompt injection through the unauthenticated prediction API to exfiltrate all loaded data to an external server or launch SSRF against internal services. The vulnerability is rated Critical (CVSS 3.1 9.3) and affects all instances deploying a CSV Agent or Airtable Agent chatflow. The most direct bypass is pd.read_json with a URL parameter, which passes all 38 regex checks and issues an HTTP request carrying the dataset; additionally, importlib can bypass the import word boundary, chr() can concatenate function names, and np.ctypeslib can load native libraries.

1. Date not given
   FlowiseAI / Trend Micro ZDI（Dre Cura, TrendAI Research）Selected

   Flowise CSV Agent node has a prompt injection remote code execution vulnerability (CVE-2026-70477)

   Trend Micro 零日计划（ZDI）披露 Flowise 的 CSV Agent 节点存在提示注入导致的远程代码执行漏洞，编号 CVE-2026-70477 / GHSA-5xvg-pmgg-3mxr，CVSS 评分 9.8，无需认证即可利用。测试版本为 3.1.1，平台为 Ubuntu 25.10。漏洞位于 CSV_Agents 类 run 方法：该方法把 CSV 列名与用户输入拼入系统提示词，将 LLM 返回的代码经 pythonCodeValidator.ts 的正则黑名单校验后直接在未沙箱化的 pyodide 中执行，而 pyodide 与宿主操作系统之间没有隔离。攻击者也可配置指向自控服务器的 chatflow，直接返回恶意 Python 载荷而绕过 LLM。PoC 提供 server、chatflow、prompt_injection 三种模式，可执行任意命令。

Current attention60·Peak in the comparable period64（Oct 8 01:00）·Change over the comparable past 24 hours 0%