Flowise prompt injection to RCE and SSRF via CSV/Airtable agent validator bypass

What's on the official record

The OSV advisory GHSA-w7x8-q2gp-5cgg reports a CRITICAL vulnerability in the npm package flowise, in the agent_framework layer, tracked as CVE-2026-73487 and CWE-94. The advisory states that Flowise versions up to and including 3.1.2 are affected, and that the issue is fixed in 3.1.3. The advisory reports that the CSV Agent and Airtable Agent nodes use a regex-based blocklist, validatePythonCodeForDataFrame(), to sanitize LLM-generated Python code before execution in Pyodide. The advisory title describes the issue as prompt injection to remote code execution and server-side request forgery via a bypass of that Python validator. The advisory is dated 7 October 2026.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Flowise deployment you run or depend on is on a version at or below 3.1.2, and whether its CSV Agent or Airtable Agent nodes are reachable by untrusted input. The advisory names 3.1.3 as the fixed version, so the record supports a decision to patch to 3.1.3 or pull the affected version where the agent nodes are in use.

For a deal team, the record lets you scope diligence on any target that embeds or operates Flowise, by confirming the deployed version and whether the CSV or Airtable agent nodes are enabled. The advisory's CRITICAL severity and the named fixed version give you a concrete condition to check before pricing or closing.

What would change this call

A statement from the Flowise maintainers that the validator bypass is not exploitable in a given deployment configuration, or a revised advisory that narrows the affected version range, would change the patch-or-pull urgency. A new advisory naming a different fixed version would change the version to require.

What to check next

Confidence

Filed 25 October 2026 from the record dated 7 October 2026.

Sources

[1] Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass — https://github.com/advisories/GHSA-w7x8-q2gp-5cgg