Flowise Vulnerability Allows Remote Code Execution via Prompt Injection
A critical remote code execution vulnerability (CVE-2026-70477) in the Flowise low-code LLM application builder allows unauthenticated attackers to execute arbitrary code.
A critical vulnerability has been discovered in Flowise, a popular low-code tool used for building applications powered by large language models (LLMs). The flaw, identified as CVE-2026-70477, carries a CVSS score of 9.8, indicating a severe security risk. It allows unauthenticated attackers to execute arbitrary code on affected installations, potentially leading to complete system compromise.
The vulnerability resides within the run method of the CSV_Agents class. The root cause is insufficient sanitization of untrusted data when constructing prompts for the LLM. Attackers can exploit this by crafting malicious input that manipulates the prompt generation process, leading to the execution of commands within the context of the service account running Flowise.
Flowise has acknowledged the vulnerability and released an update to address the issue. The fix is available through their GitHub repository, with the specific commit detailing the remediation efforts. Users of Flowise are strongly advised to update their installations immediately to mitigate the risk of exploitation.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on April 23, 2026. Following coordinated efforts between the reporter and the vendor, a public advisory was released on September 9, 2026, the same day the advisory was updated with further details. This rapid disclosure highlights the ongoing efforts to secure the rapidly evolving landscape of AI development tools.
This vulnerability was discovered by Dre Cura, who is affiliated with TrendAI Research. The Zero Day Initiative (ZDI) has published the advisory, underscoring the importance of proactive security research and responsible disclosure practices in the software development ecosystem.
The implications of this vulnerability are significant for organizations leveraging Flowise to build LLM-powered applications. Successful exploitation could lead to unauthorized access, data breaches, or the deployment of malicious software on systems running Flowise. Given the increasing adoption of LLM technologies, securing these development platforms is paramount.
This incident serves as a reminder that even low-code and visual development tools, while simplifying complex tasks, are not immune to critical security flaws. The nature of the vulnerability, involving prompt injection and code execution, is also indicative of the unique security challenges posed by AI-integrated applications. As LLM technology matures, so too will the sophistication of attacks targeting its infrastructure.
Organizations using Flowise should prioritize applying the available patch. In addition to patching, reviewing system configurations and access controls for Flowise installations can provide an additional layer of defense. Monitoring for any unusual activity on systems running Flowise is also recommended as a best practice.