Flowise CSV Agent Prompt Injection RCE
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Metasploit module that exploits CVE-2026-41264, a prompt injection vulnerability in Flowise CSV Agent, to achieve remote code execution. The module creates a malicious chatflow, injects a base64-encoded payload into a CSV file, and triggers execution via a prediction request.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented exploit for CVE-2026-41264. It creates a chatflow, injects a payload via a CSV Agent prompt, and triggers execution. No concealed backdoor, unrelated payload, credential theft, persistence, or deceptive behavior was observed. The module's actions are consistent with its stated exploit purpose.
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that actively delivers a payload to achieve remote code execution. It constructs a malicious chatflow, injects attacker-controlled commands, and triggers their execution on the target server.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:89-121Requirements
- Requires a valid Flowise API key with chatflows:create permission.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:74 - Requires an attacker-controlled Ollama API endpoint and a valid model name.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:75-76 - Target Flowise version must be between 1.3.0 and 3.0.13 inclusive.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:84
Observed behavior
- Sends a POST request to /api/v1/chatflows to create a chatflow containing a malicious CSV agent definition with an embedded payload.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:97-105 - Sends a POST request to /api/v1/prediction/{id} with a question that triggers execution of the injected Python code via exec(df["pythoncode"].iloc[0]).
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:110-120 - Deletes the created chatflow during cleanup via DELETE /api/v1/chatflows/{id}.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:123-135
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Prompt injection via CSV Agent to execute attacker-controlled Python codeThe module constructs a payload that uses os.system to execute the Metasploit payload, consistent with the described vulnerability.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:95modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:118 - Required Credentials
- APIKEY with chatflows:create permissionThe module requires an API key to authenticate to the Flowise instance, as documented in the module options.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:74 - Cleanup Behavior
- Deletes the created chatflow after exploitationThe cleanup method removes the chatflow created during exploitation, which is standard operational security for a Metasploit module.
modules/exploits/multi/http/flowise_auth_rce_cve_2026_41264.rb:123-135
What the analysis did not establish
- The analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's check method only performs version detection and does not verify the vulnerability is actually exploitable on the target.
- The Windows target is marked as 'not tested' in the source code.
- The analysis is limited to the module source file; framework mixins (e.g., Msf::Exploit::Remote::HTTP::Flowise) and external payloads are not expanded or reviewed.
- The exploit data file 'cve_2026_41264.json' referenced on line 91 is not included in the evidence, so its contents could not be inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.