Flowise Sandbox Escape via Prompt-Injected Pandas Code Execution

Technical Analysis

The CSV and Airtable Agent nodes allow LLM-generated Python snippets to be executed against user data, with a regex denylist intended to block unsafe functions (e.g., os.system, eval, exec). This denylist fails to account for pandas I/O functions like pd.read_json(), which can load arbitrary local or remote content and, depending on pandas/engine configuration, trigger deserialization or command-like side effects. The entry point is the unauthenticated prediction API, meaning an external attacker can craft a prompt-injection payload embedded in CSV/Airtable data or directly in the request that manipulates the agent into generating and executing the unsanitized code path. This crosses the boundary from data input (untrusted CSV/Airtable content) into code execution within the Flowise server process, enabling SSRF against internal services, exfiltration of connected datasets/credentials, and potentially full remote code execution on the host.

Affected Systems

Flowise

Detection Signatures

• Outbound requests to pd.read_json(), pd.read_pickle(), pd.read_sql() or similar pandas I/O calls originating from Flowise agent execution logs
• Unauthenticated POST requests to /api/v1/prediction endpoints containing embedded Python code fragments or pandas function calls
• CSV/Airtable node inputs containing suspicious strings like 'import pandas', 'read_json(', 'eval(', 'exec(', '__import__'
• Unexpected outbound connections to internal IP ranges (SSRF) immediately following prediction API calls
• Spikes in prediction API traffic from unauthenticated/unknown clients targeting CSV or Airtable Agent node IDs

Remediation Steps

1. 1

   Upgrade Flowise

   Update to Flowise 3.1.3 or later, which patches the code validator bypass.

2. 2

   Enforce authentication on prediction API

   Require authentication and rate-limiting on all prediction/agent invocation endpoints; do not expose them unauthenticated to the internet.

3. 3

   Replace regex denylist with AST-based sandboxing

   Use a proper Python AST allowlist or a hardened sandbox (e.g., RestrictedPython, gVisor, or a fully isolated subprocess with no network/file access) instead of regex pattern matching for validating LLM-generated code.

4. 4

   Network egress controls

   Restrict outbound network access from the Flowise execution environment to prevent SSRF against internal services.

5. 5

   Audit and monitor CSV/Airtable agent nodes

   Review logs for anomalous pandas function usage and treat all user-supplied CSV/Airtable content as untrusted input subject to prompt injection.