CVE-2026-69255: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-con...

Added to the CISA Known Exploited Vulnerabilities catalog on 04 Aug 2026. Vendor: AI/ML. Product: LLM.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as b...

Required action: Review and patch if applicable to your AI infrastructure.