Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-73487 · GHSA-w7x8-q2gp-5cgg

Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Risk score
91/100
CVSS
9.8 v3.1
Exploit chance (30 days)
1.0%
Published
13 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal servic…
Affected
flowise (npm) <= 3.1.2; flowise-components (npm) <= 3.1.2
Fix
Upgrade flowise to 3.1.3; flowise-components to 3.1.3 or later.
Exploitation
Public proof of concept

Story map

Story map: flowiseTHE FLAWSTHE FIXCVE-2026-73487Flowise Prompt Injection toRCE and SSRF via CSV/AirtableAgent Python Validator BypassCVSS 9.8 · EPSS 1%CVE-2026-73483Flowise NodeVM sandboxescape via puppeteer allowlist- authenticated RCE and…CVSS 8.8 · EPSS 1%Upgrade flowise3.1.3or later on your release lineWho is exposedflowise (npm) <= 3.1.2;flowise-components (npm) <=3.1.2RED · ACT TODAYflowiseFlowise before 3.1.3 contains aregex-based Python codevalidator bypass in CSV andAirtable Agent nodes that allowsunauthenticated attackers toinject malicious code via promptinjection. Attackers can exploit…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCode injection (CWE-94)239 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

flowise: Red, act today. Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal servic…

The flaws

  • CVE-2026-73487: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass (CVSS 9.8 · EPSS 1%)
  • CVE-2026-73483: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium (CVSS 8.8 · EPSS 1%)

The fix

Upgrade flowise: 3.1.3 or later on your release line

Who is exposed: flowise (npm) <= 3.1.2; flowise-components (npm) <= 3.1.2

Where it stands

  • Public proof of concept

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: python, npm

Affected packages

PackageEcosystemVulnerableFixed in
flowisenpm<= 3.1.23.1.3
flowise-componentsnpm<= 3.1.23.1.3

References

Original description

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.

Last activity 7 Oct 2026. Patch Forecast updates every hour.