CVE-2026-73485

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description A code injection issue exists in the Airtable Agent node. Unauthenticated attackers can execute arbitrary Python code by using obfuscation techniques to bypass the pythonCodeValidator blocklist. By sending crafted prompts to a chatflow using the Airtable Agent node, malicious code is executed within an unsandboxed pyodide environment, providing full access to the host operating system. Pyodide is a port of CPython that allows Python to run in the browser or other environments via WebAssembly.

Recommendations Update to version 3.1.3 or later.