CVE-2026-73485 — Flowise before 3.1.3 Remote Code Execution via Airtable Agent
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the p…
Published: 2026-08-13 · CVSS: 9.0 · CVSS 4.0
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the Airtable Agent node to inject malicious Python code that executes in an unsandboxed pyodide environment with full access to the host operating system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7