Two critical flaws in Flowise expose data and allow remote code execution

Two critical vulnerabilities in the AI workflow tool Flowise were disclosed on 7 October 2026, according to GitHub Security Advisories. Both affect Flowise and flowise-components in versions 3.1.2 and earlier. One allows remote code execution through a sandbox escape, and the other allows data theft and server-side request forgery through prompt injection. The first flaw has been fixed in version 3.1.3.

The first vulnerability, tracked as CVE-2026-73483, is a sandbox escape in the JavaScript sandbox that Flowise uses to run custom functions. According to the advisory, an authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executable path and argument values to puppeteer.launch(). This call internally invokes a process spawn outside the sandbox boundary. The advisory said this allows execution of arbitrary operating system commands as the Flowise process user, which is root in the official Docker image, and allows arbitrary host file disclosure through Chromium's file URL handling. In versions 3.0.8 to 3.1.2 exploitation requires a specific configuration setting, while earlier versions are exploitable by default.

The second vulnerability, tracked as CVE-2026-73487, affects the CSV Agent and Airtable Agent nodes. According to the advisory, these nodes use a regex-based blocklist to check Python code generated by a language model before it runs in the Pyodide runtime. The advisory said the validator has multiple structural bypasses that allow an attacker to exfiltrate all loaded data, perform server-side request forgery against internal services, and potentially achieve further code execution. All of this is reachable through prompt injection via the prediction API, which the advisory said requires no API key by default. It carries a CVSS score of 9.3.

The advisory described the blocklist approach as structurally insufficient. It uses 38 regex patterns and accepts any code that matches none of them. The advisory said the most impactful bypass is trivial: a call to pandas read_json with an attacker URL passes every check yet makes an outbound HTTP request carrying the entire dataset. The advisory noted that pandas URL-fetching functions such as read_json, read_html, read_csv and read_fwf are not blocked, that the import pattern does not match the importlib module, that the chr function is not blocked, and that the NumPy ctypeslib interface is not covered.

The advisory included proof-of-concept requests. In one, an attacker sends a question instructing the model to output Python that reads the dataset and sends up to 500 characters of it to an attacker server. The researchers said this was confirmed against a live Flowise 3.1.2 instance. A second example directs the agent to request the AWS metadata endpoint at 169.254.169.254, with the response or error returned through the agent's answer. A third uses pandas read_html as an alternative exfiltration path. The advisory said each of these functions passes the validator.

The advisory listed the affected code as the validator in the pythonCodeValidator file and the CSV Agent and Airtable Agent node files, noting the two agents follow an identical pattern. The advisory said any deployment with a CSV Agent or Airtable Agent chatflow is affected. The first vulnerability has a fix in version 3.1.3, according to its advisory.