Flowise CSV Agent Prompt Injection to Remote Code Execution

Technical Analysis

The CSV_Agents class builds a system prompt combining a dataframe column dictionary with user-supplied 'question' input, sends it to a configured LLM, and treats the LLM's raw text response as executable Python code. The only defense, validatePythonCodeForDataFrame, is a static regex blocklist that can be bypassed via string concatenation, chr() encoding, attribute aliasing, __getattribute__ tricks, frame/MRO introspection, df.query() expression evaluation, or decorator-based exec invocation. Because pyodide is not isolated from the host OS, any code that slips past the blocklist executes with the privileges of the Flowise service process, granting full code execution. The entry point is the chatflow input itself (unauthenticated in many deployments), crossing the trust boundary from user prompt to LLM output to direct code execution—a classic prompt-injection-to-RCE chain within a single agent's tool-use pipeline.

Affected Systems

Flowise, flowise-components, LangChain (LLMChain), pyodide

Detection Signatures

• Anomalous LLM-generated Python containing string concatenation to reconstruct identifiers like 'ex'+'ec' or 'imp'+'ort'
• Use of chr()-based character code obfuscation to build function/module names
• Unexpected use of __getattribute__, __class__.__mro__, or sys._getframe in generated dataframe code
• Use of df.query() with suspicious expression strings
• Decorator syntax wrapping otherwise benign-looking functions in LLM-generated code
• Log entries showing pythonCode variable containing os, sys, subprocess, socket, or eval/exec references
• Repeated validation failures followed by rephrased chatflow queries (indicative of blocklist probing)

Remediation Steps

1. 1

   Upgrade Flowise

   Update to a patched version of flowise and flowise-components beyond 3.1.2 once available; monitor the GHSA advisory for the fix release.

2. 2

   Sandbox code execution

   Replace or supplement pyodide with a properly isolated execution environment (e.g., gVisor, Firecracker, or a network- and filesystem-restricted container) so that even validator bypasses cannot reach host resources.

3. 3

   Remove reliance on static blocklists

   Adopt an allowlist-based AST validation approach for generated Python (permit only specific pandas/numpy operations) instead of regex-based denylisting of dangerous constructs.

4. 4

   Restrict CSV Agent exposure

   Require authentication and rate limiting on any chatflow using the CSV Agent node; disable the node in untrusted or public-facing deployments until patched.

5. 5

   Treat LLM output as untrusted code

   Never execute LLM-generated code directly; require human review or execute in a fully sandboxed, resource-limited subprocess with no OS-level access.