NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

🗓️ 04 Aug 2026 17:43:48Reported by PatchstackType

patchstack

patchstack🔗 patchstack.com👁 3 Views

Flowise npm RCE via CSVAgent data URI segment interpolated into Python source; affected up to 3.1.2.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-69264	4 Aug 202617:22	–	attackerkb
Circl	CVE-2026-69264	4 Aug 202618:35	–	circl
CVE	CVE-2026-69264	4 Aug 202617:22	–	cve
Cvelist	CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation	4 Aug 202617:22	–	cvelist
EUVD	EUVD-2026-52801	4 Aug 202617:22	–	euvd
Github Security Blog	Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation	4 Aug 202617:43	–	github
NVD	CVE-2026-69264	4 Aug 202618:16	–	nvd
OSV	GHSA-4J8X-X6V7-W9RQ Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation	4 Aug 202617:43	–	osv
Patchstack	NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation	4 Aug 202617:43	–	patchstack
Vulnrichment	CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation	4 Aug 202617:22	–	vulnrichment

Vulners

Node

npm flowise-componentsRange≤3.1.2

Source	Link
github	www.github.com/FlowiseAI/Flowise/security/advisories/GHSA-4j8x-x6v7-w9rq
github	www.github.com/FlowiseAI/Flowise/pull/6499
github	www.github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c
github	www.github.com/FlowiseAI/Flowise/releases/tag/[email protected]
github	www.github.com/advisories/GHSA-4j8x-x6v7-w9rq

04 Aug 2026 17:43Current

5.5Medium risk

Vulners AI Score5.5

CVSS 49.4

SSVC

Flowise CSVAgent data URI base64 encoding Python source remote code execution vulnerable versions WordPress