How to Close the Flowise CSV Agent Prompt Injection Hole Today

Originally published at vinpatel.com

In the next few minutes you'll know exactly how to close the prompt injection hole in Flowise's CSV Agent, and why the fix can't wait.

NVD just published CVE-2026-70477. Flowise is the drag-and-drop builder thousands of teams use to wire up LLM chatflows without writing orchestration code by hand, and the flaw sits in the CSV Agent node. A prompt injection buried inside an uploaded CSV can hijack a chatflow that uses that agent. The mechanism is simple and ugly: the model reads the file expecting data, finds text that looks like an instruction, and follows it instead of the user's actual request. Any Flowise instance running a version before 3.1.3, with a CSV Agent exposed to untrusted uploads, is sitting open right now.

Here's the fix, in order:

1. Check your running version. Anything before 3.1.3 has the flaw.
2. Pull 3.1.3 and redeploy the whole instance, not just the affected chatflow.
3. Find every chatflow using a CSV Agent node and confirm each one is rebuilt against the patched core.
4. Remove code execution permissions from any CSV Agent that doesn't strictly need them to do its job.
5. Add an explicit system instruction telling the agent to treat CSV contents as data, never as commands, and confirm it holds by uploading a CSV with a fake instruction row.
6. Re-run your prompt injection tests against the patched build before you mark this closed.

# check the running version, then upgrade
npx flowise --version
npm install -g flowise@3.1.3

The gotcha that will actually bite you: upgrading the core package does not retroactively patch chatflows you already built and saved. Flowise stores flow definitions separately from the engine. Skip step 3 and you'll patch the platform while leaving the one customer-facing flow that matters running on the vulnerable logic, and you won't know until someone finds it for you.

This patch closes one hole. It doesn't fix the underlying habit of trusting model output from untrusted input by default. If you're wiring agents into a broader orchestration layer the way Flowise does, the breakdown of what's actually shipping in full agentic pipelines is worth a look: the autonomous stack for end-to-end agentic products.

Subscribe for the next one of these before it's a postmortem. vinpatel.com/subscribe/