CVE-2026-73485

UNKNOWN 0.0

Flowise before 3.1.3 Remote Code Execution via Airtable Agent

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the Airtable Agent node to inject malicious Python code that executes in an unsandboxed pyodide environment with full access to the host operating system.

CWE	CWE-94
Vendor	flowiseai
Product	flowise
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for flowiseai flowise

Be the first to know when new unknown vulnerabilities affecting flowiseai flowise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

FlowiseAI / Flowise

0 < 3.1.3

FlowiseAI / Flowise

0 < 3.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c5hr-rc98-xp3g vulncheck.com: https://www.vulncheck.com/advisories/flowise-before-remote-code-execution-via-airtable-agent

Credits

🔍 zdi-disclosures