CVE-2026-73487 in Flowise
Summary
by MITRE • 08/13/2026
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within Flowise versions prior to 3.1.3 and represents a critical security flaw in the validation mechanisms of CSV and Airtable Agent nodes. The core issue stems from an inadequate regex-based Python code validator that fails to properly block malicious function calls, creating a pathway for attackers to bypass security controls through prompt injection techniques. The vulnerability specifically allows unauthenticated remote code execution through the prediction API by exploiting legitimate pandas functions such as pd.read_json() which should not be accessible to unauthorized users.
The technical implementation of this flaw involves the improper sanitization of user inputs within agent nodes that process external data sources. When attackers submit malicious payloads through CSV or Airtable agents, the regex validator does not adequately filter out potentially dangerous function calls, enabling exploitation of the pandas library functions that are typically restricted. This bypass allows attackers to leverage legitimate data processing capabilities for malicious purposes rather than being limited to safe operations.
The operational impact of this vulnerability is severe as it enables multiple attack vectors without requiring authentication credentials. Attackers can perform data exfiltration by using pd.read_json() and similar functions to access and transmit internal datasets that should remain protected. Additionally, the vulnerability facilitates server-side request forgery attacks against internal services, allowing threat actors to probe network infrastructure and potentially escalate privileges through information disclosure. The unauthenticated nature of this exploitation means that any user with access to the prediction API endpoint can execute malicious code.
Security controls based on CWE-94 (Improper Control of Generation of Code) and ATT&CK technique T1059.001 (Command and Scripting Interpreter: Python) are compromised by this vulnerability. The bypass represents a classic example of inadequate input validation that allows code injection, while the exploitation pathway aligns with ATT&CK's lateral movement and data exfiltration tactics. Organizations using Flowise versions before 3.1.3 face significant risk of unauthorized access to sensitive data and potential system compromise.
Mitigation strategies should focus on immediate patching to version 3.1.3 or later where the regex validation has been strengthened to properly block dangerous function calls. Network segmentation should be implemented to restrict access to the prediction API endpoints, and additional monitoring should be deployed to detect anomalous usage patterns that may indicate exploitation attempts. Organizations should also review their input sanitization processes and consider implementing more robust validation frameworks that can properly identify and block potentially malicious code execution paths in data processing pipelines.