Flowise CSVAgent Pyodide Sandbox Escape to Remote Code Execution

Technical Analysis

The vulnerability originates in CSVAgent.ts, where a `csvFile` data URI is split and its base64 segment is directly interpolated into a Python source template (`base64_string = "${base64String}"`) without any character validation, despite the presence of validators (`validatePythonCodeForDataFrame`, `validateCustomReadCSVFunction`) that are simply never applied to this bootstrap template. An attacker embeds a crafted string that closes the Python string literal and injects arbitrary Python, which is then executed via `pyodide.runPythonAsync`. Because Pyodide on Node.js is loaded with default options, its `js` module bridges to `globalThis`, exposing `eval` and dynamic `import()` — from within the 'sandboxed' Python execution, the attacker imports Node's `fs` or `child_process` modules and performs file writes or OS command execution in the actual host process, not inside WASM isolation. The entry point is a workspace user with chatflow creation/update permissions (an insider-adjacent or low-privilege actor), and the impact escalates to unauthenticated RCE once the malicious chatflow is exposed through the public `/api/v1/prediction/:id` endpoint, crossing the boundary from a data-processing tool call into full host takeover.

Affected Systems

Flowise, flowise-components, Pyodide

Detection Signatures

• Data URI csvFile fields containing unescaped double-quote or backslash characters followed by Python code fragments (e.g. `", import`, `"; import js`)
• Base64 segments that fail strict `^[A-Za-z0-9+/=]*$` validation before being placed in generated Python source
• Outbound use of `js.eval(...)`, `js.process.mainModule.require(...)`, or dynamic `import('fs')` / `import('child_process')` inside Pyodide execution logs
• Unexpected file writes (e.g. proof/marker files) or child process spawns originating from the Flowise Node.js process shortly after a CSVAgent prediction call
• Requests to public `/api/v1/prediction/:id` endpoints tied to chatflows containing CSVAgent nodes with anomalous csvFile payloads

Remediation Steps

1. 1

   Upgrade Flowise

   Update flowise and flowise-components to a patched version beyond 3.1.2 once available, or apply vendor mitigations for this GHSA/CVE.

2. 2

   Validate the base64 segment before interpolation

   Enforce strict character-set validation (e.g. `^[A-Za-z0-9+/=]*$`) on the extracted base64String and reject any data URI content containing quotes, backslashes, or non-base64 characters before it is placed into the Python template.

3. 3

   Harden Pyodide configuration

   Load Pyodide without exposing the JS global bridge (disable or sandbox the `js` module), or run Pyodide in a separate isolated process/container with no access to `eval`, dynamic `import()`, or Node built-ins.

4. 4

   Restrict chatflow creation and publishing permissions

   Limit which users can create/update chatflows containing CSVAgent nodes and require review before a chatflow is exposed via the public prediction API.

5. 5

   Use parameterized/templated code generation

   Avoid raw string interpolation into generated Python source entirely; pass user data via safe channels (e.g., base64 decode server-side in JS, or use Pyodide's `globals` dictionary binding instead of string formatting).

6. 6

   Network and process isolation

   Run Flowise workers with least-privilege OS accounts, restricted filesystem access, and no network egress capability to limit blast radius if RCE occurs.