{"slug": "how-to-close-the-flowise-csv-agent-prompt-injection-hole-today", "title": "How to Close the Flowise CSV Agent Prompt Injection Hole Today", "summary": "A newly disclosed vulnerability, CVE-2026-70477, affects Flowise's CSV Agent node, allowing prompt injection via malicious CSV files to hijack chatflows. The fix requires upgrading to Flowise 3.1.3, but developers must also update existing chatflow definitions to fully patch the flaw. The issue highlights the broader risk of trusting model output from untrusted input in agentic pipelines.", "body_md": "*Originally published at vinpatel.com*\n\nIn the next few minutes you'll know exactly how to close the prompt injection hole in Flowise's CSV Agent, and why the fix can't wait.\n\nNVD just published CVE-2026-70477. Flowise is the drag-and-drop builder thousands of teams use to wire up LLM chatflows without writing orchestration code by hand, and the flaw sits in the CSV Agent node. A prompt injection buried inside an uploaded CSV can hijack a chatflow that uses that agent. The mechanism is simple and ugly: the model reads the file expecting data, finds text that looks like an instruction, and follows it instead of the user's actual request. Any Flowise instance running a version before 3.1.3, with a CSV Agent exposed to untrusted uploads, is sitting open right now.\n\nHere's the fix, in order:\n\n```\n# check the running version, then upgrade\nnpx flowise --version\nnpm install -g flowise@3.1.3\n```\n\nThe gotcha that will actually bite you: upgrading the core package does not retroactively patch chatflows you already built and saved. Flowise stores flow definitions separately from the engine. Skip step 3 and you'll patch the platform while leaving the one customer-facing flow that matters running on the vulnerable logic, and you won't know until someone finds it for you.\n\nThis patch closes one hole. It doesn't fix the underlying habit of trusting model output from untrusted input by default. If you're wiring agents into a broader orchestration layer the way Flowise does, the breakdown of what's actually shipping in full agentic pipelines is worth a look: [the autonomous stack for end-to-end agentic products](https://vinpatel.com/insights/full-agentic-sdlc-2026/?utm_source=syndication&utm_medium=devto&utm_campaign=dispatch).\n\nSubscribe for the next one of these before it's a postmortem. [vinpatel.com/subscribe/](https://vinpatel.com/subscribe/?utm_source=syndication&utm_medium=devto&utm_campaign=dispatch)", "url": "https://wpnews.pro/news/how-to-close-the-flowise-csv-agent-prompt-injection-hole-today", "canonical_source": "https://dev.to/vin-patel/how-to-close-the-flowise-csv-agent-prompt-injection-hole-today-3aa1", "published_at": "2026-08-09 15:28:14+00:00", "updated_at": "2026-08-09 16:19:14.949302+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "ai-products"], "entities": ["Flowise", "CVE-2026-70477", "NVD", "Vin Patel"], "alternates": {"html": "https://wpnews.pro/news/how-to-close-the-flowise-csv-agent-prompt-injection-hole-today", "markdown": "https://wpnews.pro/news/how-to-close-the-flowise-csv-agent-prompt-injection-hole-today.md", "text": "https://wpnews.pro/news/how-to-close-the-flowise-csv-agent-prompt-injection-hole-today.txt", "jsonld": "https://wpnews.pro/news/how-to-close-the-flowise-csv-agent-prompt-injection-hole-today.jsonld"}}