Published Friday, July 10, 2026 at 07:25 PM PT
BLUF: Critical remote code execution vulnerability discovered in Flowise, an open-source visual AI application builder. Attackers can inject malicious prompts via CSV Agent functionality to achieve unauthenticated code execution. Organizations deploying Flowise should immediately assess exposure and apply patches when available.
DETAILS:
- Vulnerability: Prompt injection flaw in Flowise CSV Agent component allows remote code execution without authentication (CVE-2026-41264)
- Affected Software: Flowise — open-source drag-and-drop platform for building AI applications and chatbots
- Attack Vector: CSV Agent accepts unsanitized user input that can be weaponized to break out of intended prompt context and execute arbitrary commands
- Discoverers: Takahiro Yokoyama and ZDI Disclosures
- Metasploit Module: multi/http/flowise_auth_rce_cve_2026_41264 now available for testing/validation
IMPACT:
- Scope: Any organization or individual running Flowise instances, particularly those exposed to untrusted networks or internet-facing deployments
- Severity: Critical — unauthenticated RCE with no user interaction required beyond CSV submission
- Risk: Complete system compromise, data exfiltration, lateral movement, supply chain risk if Flowise is embedded in third-party applications
RECOMMENDED ACTIONS:
- Immediate: Identify all Flowise deployments in your environment; prioritize internet-facing instances for isolation
- Assess: Determine if CSV Agent functionality is enabled and whether untrusted users can submit CSV files
- Monitor: Check logs for suspicious CSV uploads or unusual process execution tied to Flowise services
- Patch: Apply vendor updates when released; consider disabling CSV Agent until patched
- Segment: Restrict Flowise network access to trusted sources only
SOURCES:
- Rapid7 Metasploit disclosure
- ZDI Disclosures (Takahiro Yokoyama)
- CVE-2026-41264
Note: Full patch availability and timeline uncertain at publication. Vendor guidance pending.