CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.3 are vulnerable due to a sandbox escape flaw in the pythonCodeValidator.ts file, which inadequately restricts the use of native Pandas DataFrame methods. This vulnerability allows authenticated attackers to exfiltrate sensitive CSV data or write arbitrary files to the server's filesystem, posing a significant risk to data integrity and confidentiality. Organizations using affected versions should prioritize patching to mitigate potential data breaches and unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.