CVE-2026-73487

Flowise before 3.1.3 contains a bypass of the regex-based Python code validator used in its CSV and Airtable Agent nodes, a code injection flaw (CWE-94). Because the validator's regex allowlist fails to block certain pandas calls such as pd.read_json(), an unauthenticated attacker can send a prompt-injection payload through the prediction API that causes the agent to execute attacker-chosen Python code. Exploitation can exfiltrate datasets accessible to the agent, perform SSRF against internal services reachable from the Flowise host, or achieve full code execution on the server. Any deployment of Flowise running an affected version that exposes the prediction API without authentication and uses these agent nodes is at risk. No in-the-wild exploitation is currently reported: a public advisory with exploit reference exists, EPSS is about 1% (59th percentile), and the flaw is not in CISA KEV.

What to do: Upgrade Flowise to 3.1.3 or later. Until patched, require authentication on the prediction API, restrict or disable the CSV and Airtable Agent nodes, and limit outbound network access from the Flowise host to internal services. Review logs for unexpected pandas calls such as pd.read_json() or anomalous outbound requests following user prompts.