#llm-code-execution

Flowise's CVE-2026-41264 Turns an LLM-Written `import` Statement Into Unauthenticated RCE — and Breaks the Regex-Gated Sandbox

CVE-2026-41264 (CVSS 9.8) shows how a regex import allowlist in Flowise's CSV Agent fails when the LLM writes the code: aliasing os as pandas bypasses the filter and reaches.