Detections
Analytics

SCA: security update for flowise, flowise-components (GHSA-3hjv-c53m-58jj)

critical Tenable Self-Hosted Container Security Plugin ID 440681

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0,
 the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of
 proper sandboxing when evaluating an LLM generated python script. An attacker can leverage this
 vulnerability to execute code in the context of the user running the server. Using prompt injection
 techniques, an unauthenticated attacker with the ability to send prompts to a chatflow using the CSV Agent
 node may convince an LLM to respond with a malicious python script that executes attacker controlled
 commands on the Flowise server. This vulnerability is fixed in 3.1.0. (CVE-2026-41264)

Solution

Update the flowise library and its related packages to version 3.1.0 or later.

See Also

https://github.com/advisories/GHSA-3hjv-c53m-58jj

Plugin Details

Severity: Critical

ID: 440681

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 4/21/2026

Updated: 7/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.93

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-41264

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 8.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/21/2026

Vulnerability Publication Date: 4/21/2026

Exploitable With

Metasploit (Flowise CSV Agent Prompt Injection RCE)

Reference Information

CVE: CVE-2026-41264

cwe: CWE-184