Critical Remote Code Execution via Prompt Injection in Flowise CSV Agent (CVE‑2026‑70477)
What It Is — Flowise’s CSV Agent component contains a flaw that lets an attacker inject malicious text into an LLM prompt, leading to arbitrary code execution on the service account. No authentication or user interaction is required.
Exploitability — The vulnerability is publicly disclosed, has a CVSS 9.8 (Critical) score, and can be exploited remotely with a crafted CSV file. No proof‑of‑concept is needed beyond sending the malicious payload.
Affected Products — Flowise (all versions prior to the September 2026 patch) – specifically the CSV_Agents class used for CSV‑based data ingestion.
Why It Matters for Trust & Control Assurance
- Highlights the need for input‑validation controls that span third‑party AI components, a control objective that satisfies many frameworks (e.g., NIST CSF, ISO 27001).
- Demonstrates why continuous control mapping and evidence collection are essential to prove that vendor‑supplied code meets your organization’s security policies.
- Provides a concrete example of how a missing sanitization step can break a defensible audit trail, prompting buyers to demand verifiable remediation evidence.
Recommended Actions
- Deploy Flowise’s September 2026 security update immediately.
- Review all CSV‑based ingestion pipelines for unsanitized LLM prompts; add strict sanitization or whitelist allowed tokens.
- Enable runtime monitoring and alerting for unexpected command execution in the service account context.
- Update your control‑mapping inventory to reflect the new input‑validation control and capture remediation evidence.
Source: Zero Day Initiative Advisory – ZDI‑26‑634 (CVE‑2026‑70477)