What happened
Flowise before 3.1.3 contains four critical code-injection vulnerabilities (CVE-2026-73485, CVE-2026-73486, CVE-2026-73487, CVE-2026-73601, all CVSS 9.0) in its Airtable Agent, CSV Agent, and Custom MCP nodes. The regex-based Python code validator (pythonCodeValidator) can be bypassed via obfuscation, allowing attackers to send crafted prompts to a chatflow that execute arbitrary Python code — including via unblocked pandas functions like pd.read_json() for data exfiltration and SSRF. The Custom MCP node additionally allows command injection when CUSTOM_MCP_PROTOCOL is set to stdio by manipulating environment variables and arguments (e.g., PYTHONWARNINGS).
Why it matters
Flowise is a widely-used open-source low-code LLM/agent orchestration platform. These flaws demonstrate that a static regex blocklist is insufficient to contain LLM-agent code execution nodes, and — critically — the exploitation path is a crafted prompt sent to a chatflow, meaning prompt injection directly achieves RCE, dataset exfiltration, and SSRF against internal infrastructure without requiring authentication in at least one case.
Attack vector
Attacker sends a crafted prompt to a chatflow using the Airtable/CSV Agent node, bypassing the regex-based Python code validator via obfuscation to achieve arbitrary Python code execution, or manipulates environment variables/arguments on the Custom MCP node (stdio mode) to achieve command injection
Affected systems
Flowise < 3.1.3
Mitigation
Upgrade to Flowise 3.1.3 or later