{
 "id": "AIR-2026-0895",
 "slug": "cve-2026-69264-flowise-rce-via-csvagent-data-uri-python-inte",
 "title": "CVE-2026-69264: Flowise RCE via CSVAgent data URI Python interpolation",
 "summary": "Flowise contains a remote code execution vulnerability in CSVAgent where crafted data URIs interpolate into Python templates executed by Pyodide. The flaw allows attackers to break out of string literals and execute arbitrary system commands.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise",
  "CSVAgent"
 ],
 "incident_date": "2026-08-04",
 "incident_date_precision": "day",
 "first_reported": "2026-08-04",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-4j8x-x6v7-w9rq",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-69264: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation",
   "published_at": "2026-08-04"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69264",
   "publisher": "NVD",
   "title": "CVE-2026-69264: Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python…",
   "published_at": "2026-08-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-69264",
  "rce",
  "flowise",
  "pyodide"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}