Flowise: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-73487
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 13, 2026
- Source last modified
- October 24, 2026
Description
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.
Description quoted from the NVD record.
Who is affected
Flowise, a tool for building apps that use AI language models, is affected in all versions before 3.1.3. The problem is in the building blocks that let an AI assistant work with CSV spreadsheet files and Airtable databases. A safety check meant to block harmful code can be slipped past. An attacker who does not need to log in can send crafted text through the part of Flowise that answers chat requests, which tricks it into running their code. They could then copy your data, make your server contact other internal systems, or run their own commands on the server. This flaw is rated Critical.
What to do
- If you or someone on your staff installed or runs Flowise, find out which version is in use.
- If it is older than
3.1.3, update to3.1.3or later as soon as possible. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses Flowise, ask whoever looks after your computers and online tools, and check the vendor advisory linked on this page for details.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.