CVE-2026-69264 is a template injection in Flowise that leads to remote code execution through Pyodide. The CVSS 9.4 score is technically accurate but obscures the real story: this is not merely a missing input validation check. It is an architectural assumption violation where Pyodide's browser-oriented security model was deployed into Node.js without re-evaluating what those guarantees actually mean in that context.
Flowise uses Pyodide with the default JavaScript bridge that exposes eval and dynamic import to globalThis. In a browser, Pyodide's execution model is constrained by browser sandboxing — those primitives exist but are sandboxed. In Node.js, they are not. When Pyodide runs in the Node.js runtime, the js.eval bridge becomes a direct path to Node.js built-ins, which means arbitrary code execution as the Flowise process user. The attacker does not exploit a bug in Pyodide; they exploit the gap between what Pyodide assumes about its runtime environment and what Node.js actually provides.
The attack chain is straightforward: an attacker with chatflows:create or agentflows:chatflows update permission creates a malicious CSV Agent, embedding Python code into the csvFile parameter. When that chatflow is exposed via POST /api/v1/prediction/:id, the csvFile data interpolates into a template that Pyodide executes. Because the js bridge is active, the Python code can invoke JavaScript eval, which reaches Node.js system capabilities. The RCE executes with the privileges of the Flowise process — file system access, environment variables, credentials, and any internal services the process can reach.
What makes this case analytically significant is the existence of two validators in the codebase — validatePythonCodeForDataFrame and validateCustomReadCSVFunction. These were written specifically to prevent unvalidated Python execution, which means the development team understood the risk. But they were never applied to the bootstrap template where csvFile enters the code generation pipeline. This is not a case of unknown risk; it is a case of defensive code that existed but was not systematically integrated across all execution paths. The question to pursue in your own environment: what other data entry points bypass validators that you already have?
The permission model creates an asymmetric blast radius. Planting the malicious agent requires authenticated access (chatflows:create), but detonation requires none if the prediction endpoint is exposed. In multi-tenant deployments where create access is broadly granted or where chatflows are offered as a service, this asymmetry collapses — any user can create a persistent RCE vector that any unauthenticated visitor can trigger. The EPSS score of 0.00578 likely reflects this specific configuration dependency rather than inherent rarity.
For remediation, verify what version you are on and upgrade to 3.1.3. Then investigate whether you are running Pyodide in a Node.js context and whether the js bridge is necessary for your use case. If it is not required, disabling eval and dynamic import exposure through the bridge configuration removes the execution vector. If you are using Pyodide with the default configuration in Node.js, treat that as a known architectural risk and audit for similar patterns — template injection into execution contexts where runtime assumptions may not match deployment context. This is a recurring pattern in the npm ecosystem where libraries achieve security properties in their primary runtime (browser sandbox, worker context) but get used server-side without re-evaluating those guarantees.