This CVE presents as an authenticated arbitrary code execution vulnerability in Flowise, and the CVSS 9.4 score reflects that technical severity. However, the EPSS of 0.0039 misleads if it suggests this is a low-priority issue. The EPSS measures automated bot exploitation probability, not targeted attack likelihood or the actual deployment footprint of a tool positioned as enterprise AI workflow infrastructure.
The real issue isn't whether an outsider can exploit this. It's that the "authentication barrier" is thinner than it appears. Flowise is designed as a collaboration tool for building LLM workflows, meaning every employee on an internal platform may legitimately have chatflow creation access. Once inside, an attacker isn't running whoami in a sandbox—they're executing with access to vector databases, connected databases, API credentials, and LLM prompts containing proprietary reasoning patterns.
The fix in version 3.1.3 presumably improves the denylist or removes dynamic pd. evaluation, but denylisting in a language as expressive as Python is a known losing game. This vulnerability follows a documented pattern across Jupyter (2019) and Apache Zeppelin (2021)—dynamic evaluation filtered by wordlist. Each instance trains red teamers on the same exploitation logic, shrinking the window before the next platform with this design choice gets hit.
A gap no one is discussing: the patch fixes the code but doesn't scrub malicious payloads already saved inside chatflow JSON records. An attacker who exploited this before 3.1.3 could have planted payloads that execute on every subsequent prediction call, even after upgrading. Organizations need to audit historical chatflow data, not just update the version number.
The detection problem is equally severe. There's no web shell to find, no SSH log to examine—execution is invisible by design inside the AI workflow. Your SIEM likely can't alert on anomalous pd.eval patterns in chatflow execution, and your IR playbook probably doesn't account for treating all downstream AI outputs as potentially compromised.
Finally, chatflows are designed to be shared and exported. A malicious template uploaded to a community gallery doesn't need an authenticated attacker at all—it needs a victim who imports and runs it. That's a supply chain compromise vector that makes this class of bug catastrophic in the AI tooling ecosystem specifically.
Treat the AI pipeline itself as your security boundary, not the authentication gate. Audit your stored chatflows. Assume any pre-3.1.3 artifact is potentially poisoned.