Originally published at vinpatel.com
In the next few minutes you'll know exactly how to close the prompt injection hole in Flowise's CSV Agent, and why the fix can't wait.
NVD just published CVE-2026-70477. Flowise is the drag-and-drop builder thousands of teams use to wire up LLM chatflows without writing orchestration code by hand, and the flaw sits in the CSV Agent node. A prompt injection buried inside an uploaded CSV can hijack a chatflow that uses that agent. The mechanism is simple and ugly: the model reads the file expecting data, finds text that looks like an instruction, and follows it instead of the user's actual request. Any Flowise instance running a version before 3.1.3, with a CSV Agent exposed to untrusted uploads, is sitting open right now.
Here's the fix, in order:
npx flowise --version
npm install -g flowise@3.1.3
The gotcha that will actually bite you: upgrading the core package does not retroactively patch chatflows you already built and saved. Flowise stores flow definitions separately from the engine. Skip step 3 and you'll patch the platform while leaving the one customer-facing flow that matters running on the vulnerable logic, and you won't know until someone finds it for you.
This patch closes one hole. It doesn't fix the underlying habit of trusting model output from untrusted input by default. If you're wiring agents into a broader orchestration layer the way Flowise does, the breakdown of what's actually shipping in full agentic pipelines is worth a look: the autonomous stack for end-to-end agentic products.
Subscribe for the next one of these before it's a postmortem. vinpatel.com/subscribe/