Threat · curated 8 Aug 2026
NVD - CVE-2026-70477
First reported nist.gov
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-70477 shows how indirect prompt injection against an LLM agent node can be escalated to full remote code execution, turning a chatbot input into unsandboxed code execution on the host.
CVE-2026-70477 is a critical (CVSS 9.5) vulnerability in Flowise prior to 3.1.3, where a prompt injection sent to a chatflow using the CSV Agent node can cause the LLM to emit malicious Python that bypasses the blocklist validator (validatePythonCodeForDataFrame) and executes in an unsandboxed Pyodide environment. The flaw in the CSV_Agents class run method lets an attacker achieve arbitrary code execution in the context of the service account; it is fixed in version 3.1.3.