What happened
NVD published a cluster of Critical Flowise CVEs on 2026-08-13: CVE-2026-73485/73486/73487 (CVSS 9.0) describe regex-blocklist bypasses in Airtable/CSV Agent Python code validators enabling unauthenticated code injection via prompt injection, and CVE-2026-73601 (CVSS 9.0) describes RCE in the Custom MCP node via stdio protocol environment manipulation. All are fixed in Flowise 3.1.3.
Why it matters
Flowise is one of the most widely deployed open-source no-code LLM agent builders; this is a direct, unauthenticated prompt-injection-to-RCE chain — attackers can exfiltrate connected datasets, pivot via SSRF, or fully compromise the Flowise server merely by sending a crafted prompt.
Attack vector
A prompt injection sent to a chatflow using the Airtable/CSV Agent node causes the LLM to emit a Python script that bypasses the static regex-based pythonCodeValidator blocklist via import-aliasing/obfuscation, then executes unsandboxed in Pyodide; a related Custom MCP node flaw (CVE-2026-73601, CVSS 9.0) allows RCE via stdio protocol environment-variable manipulation
Affected systems
Flowise < 3.1.3 (Airtable Agent, CSV Agent, and Custom MCP nodes)
Mitigation
Upgrade to Flowise 3.1.3 or later; review chatflows for CSV/Airtable Agent and Custom MCP nodes