CVE-2026-73486

Executive Summary

CVE-2026-73486 is a code injection vulnerability (CWE-94) affecting Flowise versions before 3.1.3, specifically the CSV Agent node's customReadCSV parameter. An authenticated attacker can supply obfuscated Python code that bypasses the parameter's static regex blocklist validator; the payload is then executed in an unsandboxed pyodide environment with full system access. Successful exploitation results in arbitrary Python code execution on the Flowise host, enabling data exfiltration, credential theft, and lateral movement. No CVSS score has been published, and the fix (Flowise 3.1.3) is currently claimed by a single OSV source without independent vendor confirmation.

Technical Analysis

The vulnerability resides in the Flowise CSV Agent node, a component that lets users define custom Python logic for reading CSV data through the customReadCSV parameter. Input validation for this parameter is implemented as a static regex blocklist — a deny-list of known dangerous keywords and patterns. This design is fundamentally flawed for validating code: a blocklist only catches previously observed payload shapes and can be trivially evaded with standard Python obfuscation techniques.

Because the parameter accepts arbitrary Python source, an attacker only needs to produce a string that (1) does not match the blocklist and (2) still yields dangerous behavior when interpreted. Common obfuscation strategies include:

• String concatenation and character arithmetic to split banned keywords across multiple tokens (e.g., building a keyword at runtime).
• Encoding the payload (base64, hex, rot13) and decoding it at execution time.
• Indirect invocation of Python's built-in execution and import mechanisms rather than using literal banned function names.
• Use of dynamically resolved attributes and dictionary-based lookups to avoid literal references.

The critical enabler is that the pyodide environment used to evaluate the Python is unsandboxed. Pyodide is normally a WebAssembly-compiled Python runtime intended for browser isolation; in this deployment it is executed server-side without an isolation boundary. Consequently, the injected Python runs with the privileges of the Flowise application process and has direct access to the host operating system: file system read/write, environment variables, network sockets, and any connected services.

From a code-audit perspective, the root cause is the combination of three weaknesses: (1) a deny-list validator that is not cryptographically or semantically robust, (2) acceptance of dynamic code into a privileged runtime, and (3) absence of sandboxing around that runtime. The first two alone produce a code injection primitive; the third elevates it to full system compromise. Insufficient technical detail is available in the NVD description regarding the exact regex contents or the precise execution flow, so the analysis intentionally remains at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available, and exploit code status is reported as unknown; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies Flowise instances exposed on the internet or internal networks, for example via Shodan dorks (e.g., http.title:"Flowise"). The attacker enumerates the login page or API endpoints and determines the deployed version of Flowise to confirm it is below 3.1.3.

2. Authentication and reachability. The vulnerability requires authentication. The attacker obtains valid credentials through legitimate access, weak-password guessing, or reuse of leaked credentials. Any authenticated user capable of creating or editing an agent that uses the CSV Agent node can reach the affected customReadCSV parameter through the user interface or the corresponding API. In multi-tenant or multi-user Flowise deployments, even a low-privileged user is a viable initial access point.

3. Payload construction and injection. The attacker edits the CSV Agent node's customReadCSV parameter and submits a Python payload that evades the static regex blocklist through obfuscation (e.g., encoding the real payload and decoding it at execution time, or assembling dangerous keywords at runtime). Because the validator is a deny-list, the obfuscated payload passes validation and is subsequently interpreted by the unsandboxed pyodide environment.

4. Execution and post-exploitation. The injected Python executes with full system access in the context of the Flowise server process. The attacker can read and exfiltrate sensitive files (configuration files, database credentials, API keys for LLM providers and connected data sources), spawn operating-system commands, establish persistence (e.g., web shells or scheduled tasks), and pivot to other hosts reachable from the compromised server. Since Flowise often orchestrates AI workflows and stores integration credentials, the blast radius extends beyond the host itself.

Impact Assessment

Although no CVSS vector or score has been published, the vulnerability should be treated as a high-severity authenticated remote code execution issue. The authentication requirement reduces the attack surface, but it does not meaningfully reduce impact: a single compromised low-privileged account can escalate to host-level compromise. Business impact includes:

• Confidentiality: Full read access to the host file system, environment variables, and any secrets held by the Flowise process (workflow definitions, prompt templates, connected service credentials, API keys).
• Integrity: Attacker-controlled code can modify application logic, inject malicious workflows, tamper with stored data, and install persistent backdoors.
• Availability: Deliberate or accidental disruption of the Flowise process and underlying host can cause denial of service to all users.

For prioritization, the EPSS score is 0.00328 (25.7th percentile of scored CVEs), indicating a relatively low predicted near-term exploitation probability compared with the broader CVE corpus. CISA KEV does not list this CVE, so there is no federal binding-operational-directive urgency. However, both observations reflect likelihood, not impact — the technical severity remains critical due to the unsandboxed code execution primitive.

Detection Guidance

Sigma Rule

Detects suspicious child processes (shells, scripting interpreters, download tools) spawned by the Flowise application process, which may indicate injected Python executing OS commands.

title: Suspicious Child Process Spawned by Flowise Application
id: 6f3a2c10-9d4e-4b7a-8c11-5e2d6f0a9d21
status: experimental
description: Detects process creation events where the Flowise application process (Node.js) spawns a shell, scripting interpreter, or download utility, potentially indicating code injection via CVE-2026-73486.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\python.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\curl.exe'
      - '\wget.exe'
    CommandLine|contains:
      - 'base64'
      - '-enc'
      - 'IEX'
      - 'Invoke-'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate administrative use of shell commands from the Flowise host
level: high

YARA Rule

Matches HTTP payloads or files containing the affected parameter name in conjunction with Python code-execution keywords and obfuscation markers.

rule CVE_2026_73486_Flowise_CSVAgent_CodeInjection {
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-02-XX"
        description = "Detects payloads targeting the Flowise CSV Agent customReadCSV parameter (CVE-2026-73486)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73486"
        cve = "CVE-2026-73486"
    strings:
        $param = "customReadCSV" ascii wide nocase
        $exec = "exec(" ascii wide nocase
        $eval = "eval(" ascii wide nocase
        $dyn_import = "__import__" ascii wide
        $b64 = "b64decode" ascii wide nocase
        $subprocess = "subprocess" ascii wide nocase
        $system_call = "system(" ascii wide nocase
        $unhex = "unhexlify" ascii wide nocase
    condition:
        $param and (any of ($exec, $eval, $dyn_import, $b64, $subprocess, $system_call, $unhex))
}

Suricata IDS Rule

Detects inbound HTTP requests to Flowise containing the customReadCSV parameter together with Python code-execution or obfuscation markers.

alert http any any -> any any (msg:"CVE-2026-73486 Flowise CSV Agent customReadCSV Python Code Injection Attempt"; flow:established,to_server; http.request_body; content:"customReadCSV"; http.request_body; pcre:"/(?:exec\s*\(|eval\s*\(|__import__|b64decode|subprocess|os\.system|\bcompile\s*\()/i"; reference:cve,2026-73486; classtype:attempted-admin; sid:202673486; rev:1;)

Elastic Detection

EQL rule that flags process starts where the Flowise process (node) spawns a shell, scripting interpreter, or download tool with suspicious arguments.

process where event.type == "start" and process.parent.name in ("node", "node.exe") and
  process.name in ("cmd.exe", "powershell.exe", "sh", "bash", "dash", "python", "python3", "curl", "wget") and
  (process.command_line like "*base64*" or process.command_line like "*curl*" or process.command_line like "*wget*" or process.command_line like "*-c*" or process.command_line like "*-enc**")

Splunk SPL Query

Searches web/access logs for Flowise requests that reference the affected parameter and contain Python execution or obfuscation indicators.

(index=web* OR sourcetype="access_combined" OR sourcetype="iis") "customReadCSV"
| regex _raw="(?i)(exec\s*\(|eval\s*\(|__import__|b64decode|subprocess|os\.system|unhexlify)"
| stats count min(_time) max(_time) values(uri) by src_ip, http_user_agent, status
| sort - count

Wazuh OSSEC Rule

Wazuh XML rule that alerts when ingested web or application logs contain the customReadCSV parameter combined with Python code-execution markers. Assumes Flowise access logs are monitored by the Wazuh agent.

<group name="flowise,">
  <rule id="100275" level="12">
    <match>customReadCSV</match>
    <regex>(?i)(exec\s*\(|eval\s*\(|__import__|b64decode|subprocess|os\.system|unhexlify)</regex>
    <description>Flowise CVE-2026-73486: potential Python code injection in the customReadCSV parameter of the CSV Agent node.</description>
    <mitre>
      <id>T1190</id>
      <technique>Exploit Public-Facing Application</technique>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED); the fix is reported by a single source (OSV) and is not independently confirmed. Apply the following in order of immediacy:

1. Immediate mitigations (no vendor workarounds published):

   • Restrict network access to the Flowise web UI and API to trusted networks/users via a reverse proxy or firewall rules.
   • Enforce strong multi-factor authentication for all Flowise accounts; disable or revoke dormant accounts.
   • If possible, disable the CSV Agent node functionality or restrict agent-editing capabilities to a small set of trusted administrators.
   • Monitor Flowise application and web logs for the detection signatures above and for any anomalous process activity originating from the Flowise host.

2. Patch/upgrade steps:

   • Verify the upstream advisory and the availability of Flowise 3.1.3 before deploying.
   • Upgrade all Flowise instances to version 3.1.3 or later in a staging environment first; validate CSV Agent functionality after the upgrade.
   • Re-audit the instance version after deployment to confirm the vulnerable parameter validator has been replaced.

3. Long-term hardening:

   • Re-architect the validation logic: replace the static regex blocklist with an allowlist approach or a proper sandbox/restricted Python execution environment.
   • Run Flowise in an isolated container or virtual machine with no unnecessary host mounts and restricted outbound network egress.
   • Run the Flowise service under a least-privilege account and prevent access to host secrets.
   • Maintain a documented inventory of Flowise instances, versions, and responsible owners so future advisories can be acted on quickly.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73486
• OSV advisory (patch source, single-source claim): https://osv.dev/vulnerability/CVE-2026-73486
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• Flowise project repository: https://github.com/FlowiseAI/Flowise
• FIRST EPSS (score reference): https://www.first.org/epss/

As of the time of writing, CISA KEV does not include CVE-2026-73486, no public exploit code or Nuclei template is available, and no known threat-actor campaigns have been attributed to this vulnerability. Organizations should nevertheless treat it as a high-priority authenticated RCE and validate the claimed patch against their own deployments.