Flowise CSV/Airtable agent Python sandbox bypass lets prompt injection exfiltrate data and trigger SSRF

FlowiseAI (affects all Flowise deployments running CSV/Airtable Agent nodes)·Flowise CSV Agent / Airtable Agent (LLM-generated Python executed in Pyodide)Fixed

Flowise's CSV Agent and Airtable Agent nodes ran LLM-generated Python code in a Pyodide sandbox after only passing it through a 38-rule regex blocklist (validatePythonCodeForDataFrame). An attacker could send a prompt-injection payload to the unauthenticated prediction API that steered the LLM to emit code using pre-imported pandas/numpy methods like pd.read_json(url), pd.read_csv(url) or pd.read_html(url) — none of which matched any blocklist pattern — causing the server to make outbound HTTP requests carrying the loaded dataset or targeting internal/cloud-metadata endpoints.

Blast radius

CVSS 3.1 9.3 (critical): full confidentiality compromise of any CSV or Airtable data loaded into the agent, plus SSRF access to internal services and cloud metadata endpoints (e.g. AWS 169.254.169.254), exploitable pre-auth against any Flowise <=3.1.2 instance with a CSV/Airtable Agent chatflow; no specific victim count or breach disclosed in the advisory.

Root cause

The sandbox relied on a regex blocklist instead of an AST-based allowlist, so URL-accepting pandas functions that are pre-imported into the execution context (pd.read_json, pd.read_csv, pd.read_html), plus edge cases like the \bimport\b word-boundary missing importlib and chr()-based string construction, were never covered by any of the 38 forbidden patterns.

How it was caught

Found by independent researcher Peyton Kennedy (p80n-sec, Endor Labs) via proof-of-concept testing against a live Flowise 3.1.2 instance, including a validator test script showing 5 of 6 bypass payloads passing; it was not caught by Flowise's own validator and was not addressed by the prior ZDI-reported fix for a related bypass (GHSA-3hjv-c53m-58jj).

What changed

FlowiseAI shipped a patch in flowise and flowise-components 3.1.3; the advisory recommends replacing the regex blocklist with AST-based allowlisting of safe DataFrame operations, explicitly blocking URL-accepting pandas functions (read_json/read_csv/read_html/read_fwf/read_sql/read_table) and np.ctypeslib, and running the Pyodide sandbox without outbound network access.

Take-awayDon't secure LLM-generated code execution with a string/regex blocklist — use an AST-based allowlist and network-isolate the sandbox, since every pre-imported library method (not just obvious calls like eval/exec/import) is part of the attack surface.