Detections
Analytics
SCA: security update for flowise, flowise-components (GHSA-5xvg-pmgg-3mxr)
critical Tenable Cloud Security Plugin ID 445654
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a
prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious
Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment.
The specific flaw exists within the run method of the CSV_Agents class, where untrusted data is used to
construct an LLM prompt and the resulting pythonCode is validated by validatePythonCodeForDataFrame before
execution. An attacker can leverage this to execute arbitrary code in the context of the service account.
This issue is fixed in 3.1.3. (CVE-2026-70477)
Solution
Update the flowise library and its related packages to version 3.1.3 or later.See Also
Plugin Details
Severity: Critical
ID: 445654
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 8/5/2026
Updated: 8/5/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.13
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-70477
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.5
Threat Score: 8.4
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/4/2026
Vulnerability Publication Date: 8/4/2026
Reference Information
CVE: CVE-2026-70477
cwe: CWE-94