Flowise, a popular platform for building AI agents and automated workflows by wiring language models together with business tools, is facing six newly disclosed remote code execution vulnerabilities. Collectively, the flaws could let an authenticated attacker run arbitrary commands on the underlying server, exposing whatever data, credentials, and connected systems that server can reach.

A Familiar Weak Point, Six Times Over

Researchers at Elttam uncovered the issues while auditing Flowise versions 3.1.1 and 3.1.2. According to their report, shared with Cyber Security News, several of the flaws exist because earlier security fixes were incomplete, meaning the team was able to find new paths around protections Flowise had already shipped to address prior vulnerabilities. The affected components span a wide slice of the platform: CSV processing, custom JavaScript execution, MCP (Model Context Protocol) configuration, database connector nodes, and record-management features.

That breadth matters because of what Flowise is typically used for. It sits at the center of AI agent pipelines, connecting language models to files, internal databases, and external services. A successful compromise doesn’t just hand an attacker the Flowise server itself, it potentially opens a path into every system that server is wired to.

Breaking Down the Bugs

The first issue lived in the CSVAgent feature, which lets users supply custom pandas code to process uploaded spreadsheets. Flowise had tried to block risky Python functions with a denylist, but Elttam found ways to abuse legitimate pandas functionality to reach operating-system-level commands anyway. An initial patch attempted to close the gap by blocking unsafe deserialization and requiring input to start with a read_csv call, but the researchers discovered a crafted expression that satisfied those restrictions while still reaching OS functionality through pandas. Flowise’s developers ultimately removed the affected CSVAgent and AirtableAgent components entirely after further review turned up additional normalization concerns.

A second flaw targeted Flowise’s use of the vm2 JavaScript sandbox, which is supposed to isolate custom scripts from the host system. The sandbox allowed certain external modules by default, including the moment library, and Elttam used that allowance as a stepping stone to escape the sandbox and execute code directly on the host.

A third issue involved environment-variable injection in Custom MCP configurations. Attackers could manipulate settings passed to a spawned process, including Python-related variables, to trigger unintended code execution. Flowise had introduced checks meant to block dangerous values, but researchers reported finding a bypass that remained unpatched at the time their report was published.

Rounding out the set, three additional flaws were found in the TypeORM DataSource options, the SQL Database Chain node, and the SQLite Record Manager node. Each could be abused to write or load attacker-controlled content in unsafe ways, and when chained with other Flowise functionality, could similarly lead to code execution on the server.

A Pattern in AI Agent Platforms

This isn’t the first time exposed Flowise infrastructure has drawn attacker attention. Prior research has already documented injection issues affecting the platform and separate weaknesses in its MCP integration, both of which made publicly reachable Flowise instances an attractive target. The new findings reinforce that pattern: as more organizations stand up self-hosted AI agent and workflow platforms, often exposing management interfaces to speed up internal adoption, those platforms are becoming a recurring soft spot in otherwise well-defended environments.

Hardening AI Workflow Servers

For teams running Flowise or similar AI orchestration platforms, the guidance emerging from this research is consistent with broader AI infrastructure security advice:

• Apply the latest Flowise patches and track vendor advisories closely, since several of these bugs represent bypasses of prior fixes rather than entirely new categories of flaw
• Avoid exposing Flowise admin or workflow-builder interfaces directly to the internet; place them behind authentication gateways and network segmentation
• Restrict what custom code, database connections, and MCP configurations authenticated users are allowed to define, since several of these flaws required only standard user-level access to trigger
• Monitor AI workflow servers for anomalous outbound connections or unexpected process execution, the same way any application server handling sensitive integrations would be monitored

As AI agent platforms increasingly sit between language models and an organization’s real infrastructure, the security bar for these tools needs to rise to match the access they’re granted, not lag behind it.