The CVSS 9.5 on this CVE is earned not by a single critical flaw but by a compounding failure chain that should concern every team deploying LLM-agent frameworks. Here's what actually happened and what you should do about it.
The attack works in four stages. First, an attacker injects a malicious prompt into CSV_Agents that manipulates the LLM into generating Python code designed to bypass the blocklist validator. Second, the LLM acts as an attack amplifier—it transforms a relatively simple prompt injection into novel exploit code that has never been seen before. Third, the blocklist validator (validatePythonCodeForDataFrame) fails because blocklists cannot defend against code written by an intelligent system; the attack surface isn't static code but semantic space, which cannot be enumerated. Fourth, and most critically, that code executes in an unsandboxed Pyodide environment.
That last point is the one that elevates this from concerning to dangerous. Pyodide is designed to run Python inside a WASM sandbox with restricted system access. Flowise is running it without that sandbox, which means code execution happens as the service account Flowise runs under—not in an isolated browser-like context. If that service account has access to databases, cloud credentials, external APIs, or other integrated systems (and the drag-and-drop architecture exists precisely because it connects to these things), you're not looking at code execution on a single box. You're looking at a potential pivot point for lateral movement across your entire connected infrastructure.
The EPSS of 0.00444 versus the CVSS of 9.5 creates a misleading sense of safety. Low EPSS typically means this isn't being actively exploited yet, which gives you a window—but the gap likely reflects exploit complexity rather than rarity. The real question is whether the unsandboxed Pyodide configuration is specific to CSV_Agents or whether other agent nodes inherited the same exposure. If it's architectural rather than intentional, dozens of agent types may share the vulnerability pattern.
What you should do: First, verify whether your Flowise deployment is running Pyodide sandboxed or unsandboxed—check the configuration and the execution environment, not just the version. Second, audit what the service account running Flowise can access; treat any connected system as potentially compromised if this vulnerability is exploited. Third, the patch in 3.1.3 likely addresses CSV_Agents specifically, but you need to determine whether it changes how LLM-generated code is validated across all agent types or just adds more patterns to the blocklist. If it's the latter, assume other agents are still vulnerable and prioritize accordingly.