[ CVE-2026-73487 · Published 13 Aug 2026 ]
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
CVSS 9.0
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
- Critical severity: CVSS 9.0
[ Description ]Official description
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.
[ Fixes ]Fixes and patches
- flowise 3.1.3Fixed version · GitHub Advisories · npm package flowise: upgrade to 3.1.3 or later (affected <= 3.1.2)
- flowise-components 3.1.3Fixed version · GitHub Advisories · npm package flowise-components: upgrade to 3.1.3 or later (affected <= 3.1.2)
[ Packages ]Affected open-source packages
- flowise npmAffected <= 3.1.2 · fixed in 3.1.3 · GHSA-w7x8-q2gp-5cgg
- flowise-components npmAffected <= 3.1.2 · fixed in 3.1.3 · GHSA-w7x8-q2gp-5cgg