Flowise before 3.1.3 — regex-based Python code-validator bypass in CSV and Airtable Agent nodes reachable by prompt injection through the unauthenticated prediction API

UPDATE — a fourth Flowise flaw lands, and unlike the three covered a week ago this one has a fixed version: CVE-2026-73487 reaches code execution through prompt injection into the unauthenticated prediction API

UPDATE · originally covered Flowise ships three new CVEs into a sunset — an unauthenticated auth bypass that defeats an earlier fix, and cross-workspace credential access, with no vendor left to patch them (2026-08-08)

the earlier entry recorded three VulnCheck-assigned Flowise CVEs whose advisory links pointed at the vendor's own sunset announcement, with BSI marking its advisory unpatched and no vendor left to fix them — the operational conclusion being that self-hosted operators owned the compensating controls. A fourth CVE has now landed and it inverts that conclusion in one respect.

VulnCheck assigned CVE-2026-73487 on 2026-08-13 at CVSS 9.0, with the vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. Flowise before 3.1.3 contains a regex-based Python code-validator bypass in the CSV and Airtable Agent nodes that lets unauthenticated attackers inject code via prompt injection, exploiting unblocked pandas functions such as pd.read_json() to exfiltrate datasets, perform server-side request forgery against internal services, or achieve code execution through the unauthenticated prediction API (VulnCheck, 2026-08-13). The delta that matters operationally is the last field of the record: there is a fixed release, 3.1.3.

Two things are worth separating. The defect class is a familiar one for this product line — a denylist implemented as a regular expression over generated Python, defeated by reaching a function the pattern does not name — and it is the same shape as the earlier auth-middleware bypass that defeated a prefix-based allowlist. The reachability is what makes it more than an application bug: the injection travels through the prediction API, which takes untrusted natural-language input by design and needs no authentication, so the attacker's input reaches the validator without any credential step in between. An agent node that turns a prompt into executed pandas code is doing exactly what it was built to do; the control that was supposed to bound it is the validator, and the validator is what broke.

The vendor's broader position has not changed — the earlier entry's reasoning about a sunset product still governs the medium-term decision — but the immediate action for anyone still running Flowise is now an upgrade rather than a compensating control. Detection concepts, telemetry class first: in application-access telemetry, unauthenticated requests to the prediction API whose payloads reference pandas entry points or file and URL-loading functions rather than the question-shaped input the flow expects; in egress telemetry from the host running Flowise, outbound requests to internal addresses or metadata endpoints originating from the Flowise process, which is the server-side-request-forgery half of the same primitive; in process-execution telemetry, any child process of the Flowise runtime.