CVE-2026-41265 is a critical remote code execution flaw (CVSS 9.8) in the Airtable Agent node of Flowise. In versions up to 3.0.13 the node evaluates an LLM written Python script without sandboxing. Upgrade to Flowise 3.1.0, which fixes it.
What's affected
The GitHub advisory lists the npm packages flowise and flowise-components at 3.0.13 and earlier, with 3.1.0 as the patched version. Only chatflows that include the Airtable Agent node reach the affected code.
The advisory reproduces a Zero Day Initiative report (ZDI-CAN-29412). It says an attacker who can send prompts to such a chatflow may convince the model to answer with a malicious script that then runs on the Flowise server.
How to check if you're exposed
npm ls flowise flowise-components
For containers, read the image tag you deploy. Then review your flows for the Airtable Agent node. If none uses it, the exposure from this specific CVE is smaller, but several other Flowise CVEs share the same fixed version, so upgrade regardless. A dependency scan can list the Flowise version pinned in your repositories.
What to do now
- Upgrade to Flowise 3.1.0 or later.
- Disable chatflows with the Airtable Agent node, or restrict who can message them, until you have upgraded.
- Run the server as a low privilege user with tight network access.
- Review server activity for anything odd if the flow was open to the public.
Why it matters
The NVD record lists CWE-77, command injection. As with the sibling CSV Agent bug (CVE-2026-41264), the cause is executing model generated Python without a sandbox. The model is a translator between user text and code, and the code runs with the server's rights.
You cannot fix this class by asking the model to behave. The control has to sit outside the model: isolate execution, drop privileges and limit who can prompt the flow. The record does not flag this CVE as known exploited.
Quick check
Is this the same bug as the CSV Agent one?
It is the same class in a different node. Each has its own CVE, and both are fixed in 3.1.0.
Sources
Last reviewed: 19 October 2026.
