Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND in Action — Flowise CSV Agent: Prompt Injection Bypasses a Regex Blocklist and Reaches Host-Capable Pyodide
- Primary source — CSV Agent Prompt Injection Remote Code Execution Vulnerability (GHSA-5xvg-pmgg-3mxr), Dre Cura / TrendAI Research, 2026-07-29
- AIDEFEND SecureFlow — Flowise CSV Agent Prompt Injection to Host-Capable Pyodide
CVE-2026-70477 affects Flowise and flowise-components through 3.1.2 and is fixed in 3.1.3. An unauthenticated attacker sends instructions to a chatflow containing a CSV Agent. The LLM returns obfuscated Python; the static regex blocklist in validatePythonCodeForDataFrame() accepts it; Flowise passes the code to Pyodide. Because that runtime was not isolated from host operating-system interfaces, the payload executes with the privileges of the user running the Flowise server.
The advisory demonstrates eight bypass variants — string concatenation, chr() encoding, builtin aliasing, frame inspection, MRO traversal, df.query(), and decorator-based indirect execution — establishing that the denylist is a class-level failure rather than a single missed pattern. The advisory states the route is conditional: it requires a reachable chatflow using the affected node and an LLM response that produces a working bypass.
ASSESSED SYSTEM
A Flowise deployment on flowise/flowise-components through 3.1.2, in its pre-3.1.3 state, exposing a chatflow that contains the CSV Agent node: an unauthenticated caller can send instructions to the chatflow, the LLM returns Python, Flowise strips code fences, applies validatePythonCodeForDataFrame(), prefixes pandas and NumPy imports, and invokes pyodide.runPythonAsync(). Representative configuration: any low-code LLM pipeline that admits model-generated code to an execution sink behind a static denylist. Scored pre-remediation, in the default configuration the advisory exercised.
OUT OF SCOPE
The attacker and the eight documented bypass variants are not the assessed system. Pyodide as an upstream project is out of scope; the advisory's finding is that Flowise used it outside an isolation boundary, not that Pyodide is defective. Flowise 3.1.3 and later, and any deployment that removed or gated the CSV Agent node, are out of scope. The underlying LLM provider is not assessed: the advisory notes injection may need several attempts depending on the model, which is a property of the model, not of this deployment's controls.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q1 = NO: one model, no peer agents. Q2 = NO: the advisory describes a single request-scoped generate-then-execute path, not an autonomous multi-step planning loop that maintains task state. Q3 = YES: the model's output is passed by the application to an external execution function — pyodide.runPythonAsync() — so the model drives a connected capability rather than only returning text. Evidence in the brief: the CSV Agent node, the fence-stripping and import-prefixing step, and the execution call itself. Tier 3: Tier 3 (Internal): Flowise chatflows are low-code integration infrastructure typically deployed inside an organisational boundary for analytics and internal assistants, which is the same treatment given to the ChromaDB vector-database case. The advisory's own remediation is framed as removing or restricting public access to affected chatflows rather than as consumer-product guidance. The fact that the disclosed path is reachable unauthenticated is carried by the ORP Attack Surface dimension (As = 1.00), not by raising the tier.
Documented attack or failure path
- An unauthenticated caller sends instructions to a reachable chatflow that contains the CSV Agent node.
- The LLM returns Python that encodes a dangerous construct through concatenation, chr(), builtin aliasing, frame inspection, MRO traversal, df.query(), or a decorator rather than through a literal blocked token.
- Flowise removes code fences, calls validatePythonCodeForDataFrame(), prefixes pandas and NumPy imports, and admits the result; the static regex blocklist does not recognise the obfuscated construct.
- Flowise invokes pyodide.runPythonAsync() on the admitted code. The advisory states that code which passed validation retained access to host OS interfaces and ran in the context of the user operating the Flowise server.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- A validation step existed and was invoked on every generated snippet: validatePythonCodeForDataFrame() ran before execution, and the advisory required eight non-trivial obfuscation variants to defeat it. Cn-3 is scored at 0.25 rather than 0.00 on this basis.
- The advisory is explicit that this is not an AST-validation or template-interpolation flaw, so the parsing and interpolation layers are not scored as failures.
- The route is conditional on a reachable chatflow using the affected CSV Agent node; deployments without that node were not shown to be exposed.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.72 (midpoint 0.36), Tier 3 MVT 0.40 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.00w 0.28 | 0.00 anchor: no adversarial input control is evidenced on the request boundary and the system fails the injection attempts the advisory ran. The 0.25 anchor requires basic filters that resist naive attacks; the only filter in the path inspects generated code, not the incoming instruction, so the input boundary has no control at all. | The disclosed path begins with an unauthenticated attacker sending instructions to the chatflow and ends with the model returning working obfuscated Python. No prompt-injection gate exists in front of the primary LLM — AID-H-002.002 is recommended precisely because there is nothing to reject or quarantine a suspicious request before prompt assembly, and the brief marks its contribution 'Partial' because it would only reduce successful malicious code generation.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.04–0.57 (midpoint 0.30), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | 0.00 anchor: no effective scope boundary existed — the executed code could reach host resources that a dataframe operation never authorises. The 0.25 anchor requires boundaries that exist but are inconsistently enforced; here the containment boundary the application depended on (Pyodide) was, in the advisory's words, not the containment boundary the application needed. | The advisory states that code which passed validation retained access to host operating-system interfaces and ran in the context of the user operating the Flowise server. A CSV data-analysis node therefore reached the host process boundary. AID-I-001.003 is recommended to place each evaluation in a fresh microVM, gVisor, or Kata boundary with the Flowise host process, filesystem, credentials, and management plane outside it, which indicates no such boundary existed.source: brief |
| Cn-2Escalation Prevention | 0.00w 0.12 | 0.00 anchor: no escalation control is evidenced. The request's authority is the server operator's authority, with nothing in between; the 0.25 anchor requires role checks that exist but can be defeated, and no role boundary exists on this path. | An unauthenticated chat request converted into execution at the privilege of the account running the Flowise server. No privilege reduction, dedicated execution principal, or step-up check sits between the chatflow request and the interpreter; the advisory's remediation asks defenders to remove host credentials, writable mounts, management sockets, and unrestricted network access from the evaluation boundary.source: brief |
| Cn-3Output Filtering Robustness | 0.25w 0.16 | 0.25 anchor: a basic filter exists and resists naive attacks — the eight documented bypasses are deliberate obfuscation techniques, not trivial rewrites — but it is defeated by straightforward adaptive variation. The 0.50 anchor requires filtering that survives systematic evasion, which eight independent working variants disprove. | validatePythonCodeForDataFrame() is a real release gate on model output and it ran on every snippet, but it is a static regex denylist. The advisory demonstrates eight successful variants — string concatenation, chr() encoding, builtin aliasing, frame inspection, MRO traversal, df.query(), and decorator-based indirect execution. AID-H-025.001 recommends replacing it with a fail-closed, signed-policy AST admission gate over the exact Python bytes.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.07 | 0.00 anchor: no pre-execution reversibility classification is performed and automated actions execute ungated (ARCR = 0). No chain composition rule exists either — the interpreter invocation is the terminal hop and nothing upstream constrained it. | Host-privileged code execution is a delegated-irreversible action class, and it executed with no pre-execution reversibility classification and no gate. The only pre-execution decision in the path was a lexical denylist over the code text; nothing classified the action's reversibility or required an approval bound to its impact.source: researcher |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.20 | The deployment executes model-generated code automatically with no human approval on the path, which is more than tool invocation under review. It falls short of the 1.00 anchor because the advisory describes a single request-scoped generate-then-execute step rather than an agent that independently plans, chains, and commits transactions across a session. |
| AsAttack Surface Exposure | 1.00w 0.25 | The advisory states that an unauthenticated attacker sends the instructions. Untrusted, unauthenticated input from an open network reaches the model context directly and its output reaches an execution sink, which is the maximum-exposure condition in the rubric. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates in host operating-system execution under the server operator's account — an irreversible node with reach beyond the AI component into the host filesystem, credentials, and management plane, which triggers g_P = 1.00.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.25 | The 0.25 anchor fits: this is a deployment-infrastructure fix with a released artefact. Flowise 3.1.3 closes the disclosed path, no retraining is required, and the compensating controls the advisory names — disabling public chatflow access and removing the CSV Agent node from untrusted workflows — are configuration changes. Remediation is bounded by rollout verification rather than by uncertainty about what to fix. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.20 | Below the 0.25 anchor. The advisory identifies the product, affected version range, the exact node, the validation function, the execution call, and the fixed release, but no deployment owner, base model, tool manifest, identity policy, or evaluation artefact for any specific installation. No AIBOM or equivalent record exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.18 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-07-29; age 81 days on the workpaper reference date. Components: C_event 0.35 · C_monitor 0.65 · T_calendar 0.74 · C_evidence 0.85. Binding term: C_event. C_monitor 0.65 — no detection of the bypass is evidenced and the advisory has to recommend that defenders start reviewing prediction requests and execution telemetry for repeated obfuscated Python attempts, which indicates no such monitoring was in place. C_event 0.35 — a confirmed critical-invariant violation in the assessed configuration: model-generated code reached host-privileged execution. C_evidence 0.85 — a fixed release exists but the finding stays open until the deployed population is reconciled against it; the advisory's own guidance treats disabling public chatflow access as an interim control. BAW does not apply: no mutable behavioural state, memory, or multi-session accumulation is evidenced, so the four-item checklist is not met. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.23 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
5.5 midpoint, interval 2.4–8.7; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2026-70477 CVSS 4.0 Base 9.5 Critical
| Published score | 9.5 |
|---|---|
| CVSS version | 4.0 |
| Metric group | Base |
| Severity | Critical |
| Vector | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| Scored by | GitHub_M |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70477.json (accessed 2026-10-18) |
| Affected component | Flowise |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | 8c1ecd1b0d53589fde6f65d4cd886e279fb3a8fb23576e430df59fa861f006c2 |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-025.001 | Pre-Execution Static Analysis & Dangerous Construct BlockingAIDEFEND dataVersion 2026.10.15. Replacing the regex denylist with a fail-closed, signed-policy AST admission gate over the exact Python bytes is the control whose absence sets Cn-3 at 0.25 rather than higher; a clean AST result still does not prove arbitrary code safe. | Very High | Cn-3 |
| AID-H-025.002 | Safe Interpreter EnforcementAIDEFEND dataVersion 2026.10.15. Routing permitted evaluations only to an explicitly allowlisted restricted interpreter, chosen by an execution gateway rather than by the model, is the Cn-3 enforcement layer the assessed configuration lacks. | Very High | Cn-3 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsAIDEFEND dataVersion 2026.10.15. A fresh single-use microVM, gVisor, or Kata boundary per evaluation, with the Flowise host process, filesystem, credentials, and management plane outside it, is the Cn-1 control whose absence the advisory states directly. | Very High | Pr-2 Cn-7 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.10.15. Reconciling the deployed Flowise population against the advisory and redeploying 3.1.3 or later with digest-level completion evidence is the Rf remediation route; it is not IVP evidence for this case. | High | Ro-4 Ro-5 Tr-4 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationAIDEFEND dataVersion 2026.10.15. A calibrated prompt-injection gate before the primary LLM is the missing Ro-1 control. The brief marks its contribution 'Partial' because it is a bounded first layer that cannot replace executable-artifact admission or runtime isolation. | Partial | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
WHAT THIS CASE TEACHES
A denylist is not an admission gate. The control that was present ran on every snippet and still scored only 0.25, because Cn-3 measures survival under systematic evasion and eight independent working bypasses are exactly that evidence; meanwhile the two boundaries that would have contained the failure — an input gate and an execution sandbox — were absent entirely and scored 0.00.
Sources: AIDEFEND in Action — Flowise CSV Agent: Prompt Injection Bypasses a Regex Blocklist and Reaches Host-Capable Pyodide · Primary source — CSV Agent Prompt Injection Remote Code Execution Vulnerability (GHSA-5xvg-pmgg-3mxr), Dre Cura / TrendAI Research, 2026-07-29 · AIDEFEND SecureFlow — Flowise CSV Agent Prompt Injection to Host-Capable Pyodide
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- Flowise CSV Agent Prompt Injection to Host-Capable Pyodide (same incident · AIDEFEND curated research flow)ATLAS techniques: AML.T0051.000, AML.T0107, AML.T0050