RCE in Flowiseai Flowise
CVE-2026-73487
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions…
Vulnerability class: RCE (Remote Code Execution)
Affected products
- Flowiseai Flowise — versions 0, 3.1.3
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)