CVE-2026-73485 in Flowise
Summary
by MITRE • 08/13/2026
Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the Airtable Agent node to inject malicious Python code that executes in an unsandboxed pyodide environment with full access to the host operating system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical code injection flaw in Flowise versions prior to 3.1.3, specifically within the Airtable Agent node component. The weakness stems from inadequate input validation and sanitization mechanisms that fail to properly block malicious Python code execution attempts. Attackers can exploit this vulnerability by crafting specially formatted prompts that bypass the pythonCodeValidator blocklist through sophisticated obfuscation techniques, effectively circumventing security controls designed to prevent unauthorized code execution.
The technical implementation of this vulnerability allows unauthenticated attackers to inject arbitrary Python code into the system through the Airtable Agent node interface. The attack vector operates within an unsandboxed pyodide environment where the injected code maintains full access to the host operating system, creating a severe privilege escalation risk. This environment lacks proper isolation mechanisms that would normally prevent code from accessing underlying system resources or executing harmful operations.
The operational impact of this vulnerability is substantial as it enables remote code execution without requiring authentication credentials, making it particularly dangerous in production environments. Attackers can leverage this weakness to execute arbitrary commands on affected systems, potentially leading to complete system compromise, data exfiltration, or further lateral movement within network infrastructures. The unsandboxed nature of the pyodide environment eliminates protective boundaries that would typically contain malicious code execution.
Organizations using Flowise versions before 3.1.3 face significant security risks as this vulnerability can be exploited by threat actors with minimal technical expertise to gain unauthorized access to systems. The attack requires only the ability to interact with a chatflow utilizing the Airtable Agent node, making it accessible through various network-based attack vectors. This vulnerability directly aligns with CWE-94, which describes improper control of generation of code, and maps to ATT&CK technique T1059.006 for execution through Python commands.
Mitigation strategies should focus on immediate patching to Flowise version 3.1.3 or later, which includes enhanced validation mechanisms for the Airtable Agent node. Organizations must also implement network-level controls such as firewall rules that restrict access to affected chatflows and monitor for suspicious prompt patterns. Additional defensive measures include disabling unnecessary nodes in production environments, implementing stricter input validation at multiple layers, and conducting thorough security assessments of all custom chatflow configurations. The vulnerability demonstrates the critical importance of proper code validation and sandboxing mechanisms in low-code development platforms where user inputs can directly influence system behavior through code execution pathways.