CVE-2026-73485

Flowise before 3.1.3 contains a code injection flaw (CWE-94) in the Airtable Agent node, where the pythonCodeValidator blocklist can be bypassed using obfuscation techniques. An unauthenticated attacker can send a crafted prompt to a chatflow that uses the Airtable Agent node, causing injected Python code to execute. Because the code runs in an unsandboxed Pyodide environment with full access to the host operating system, the attacker gains arbitrary code execution on the underlying host. Only Flowise deployments running versions before 3.1.3 whose chatflows include the Airtable Agent node are affected. There is no confirmed in-the-wild exploitation yet; a public vendor security advisory exists and EPSS currently estimates a 0.6% chance of exploitation in the next 30 days.

What to do: Upgrade Flowise to version 3.1.3 or later, which fixes the blocklist bypass. Until upgraded, audit chatflows for use of the Airtable Agent node and disable or restrict exposure of any chatflows that use it, especially instances reachable from untrusted networks. Monitor instance logs for unexpected Python execution or outbound activity originating from chatflow prompts.