CVE-2026-69255

CVE-2026-69255 is a high-severity (CVSS 9.2) vulnerability in Flowise, an LLM orchestration platform, where unsanitized CSV data loaded through the CSVAgent component is executed as Python code via Pyodide — and from there, the Pyodide JavaScript bridge allows escalation to OS command execution. The root cause isn't just a parsing oversight. Flowise's architecture creates a dangerous mental framing trap: developers treated the drag-and-drop flow configuration interface as 'behavior configuration' rather than 'data processing,' even when that data flows into the same Pyodide execution context that LLM-generated code uses. A validation function called `validatePythonCodeForDataFrame()` exists to sanitize Python code — but it was positioned to defend the LLM code generation path, not the initial CSV loading path. Both paths end in identical Pyodide execution, but only one was in scope when the denylist was written. That's the seam: the same execution engine, two data sources, one validation layer. The Pyodide integration creates a permanent Python-to-JavaScript bridge (`js.bridge`) that Flowise inherited without fully auditing which execution contexts would inherit it. Pyodide documentation explicitly warns about this escalation path, but in the workflow of building a no-code LLM tool, 'arbitrary Python execution' didn't map cognitively to 'arbitrary shell execution' — the security implications were scoped to the wrong threat model. The EPSS score of 0.00313 reflects low exploitation probability in the wild, but this likely reflects the authentication requirement rather than inherent difficulty. Flowise is typically self-hosted, meaning an attacker needs valid credentials before reaching the execution environment. Once authenticated, any user becomes a potential code execution vector — the outer authentication gate shifts the attacker profile, not the security posturing. For multi-tenant deployments, this is the realistic threat model, not unauthenticated remote exploitation. Check whether your deployment runs version 3.1.3 or later. Audit any component that loads user-provided data (CSV, JSON, text files) into Pyodide or similar code execution runtimes — validate the entire data pipeline, not just the code-generation endpoint. If Pyodide remains in your architecture, verify whether the JavaScript bridge has been explicitly restricted. The fix addressed the CSV loading path, but the architectural question of whether user data should execute as code at all remains the deeper remediation decision.

Reviewed through automated stages and approved by a human before publication.