CVE-2026-41137

Flowise CVE-2026-41137 affects the Flowise UI stack, specifically the CSVAgent component, which allows providing a custom Pandas CSV read code. The lack of sanitization enables a command-injection payload to be interpolated and executed by the server. This is documented across multiple sources, w...

PT-2026-34729

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the...

PT-2023-10811 · Polterguy · Phosphorus Five

Name of the Vulnerable Software and Affected Versions: polterguy Phosphorus Five versions up to 8.2 Description: A critical issue has been found that affects the csv.Read function of the CSV Import component, specifically in the file plugins/extras/p5.mysql/NonQuery.cs. This issue leads to sql...