CVE-2026-73485: High Code Injection in Flowise Airtable Agent

CVE-2026-73485 is a code injection flaw (CWE-94) in the Airtable Agent node of Flowise, the open source low-code builder for AI agents. The record rates it High at 8.8. Flowise 3.1.3 fixes it, so upgrade to that release or later and review which of your chatflows are reachable by outsiders.

What's affected

The record says Flowise before 3.1.3 is affected. The GitHub advisory (GHSA-c5hr-rc98-xp3g) narrows that to the flowise-components npm package at version 3.1.2 and earlier, with 3.1.3 listed as the patched version. The reporter tested version 3.1.1.

Only chatflows that use the Airtable Agent node are in the path, but the node ships with the product, so any instance on an affected version has the code present.

Severity, as two sources state it. The record carries CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, a score of 8.8, which is High. The GitHub advisory text quotes a Zero Day Initiative score of 9.8 (no privileges required), and VulnCheck lists it as critical at 9.0 under CVSS 4.0. The record also says "unauthenticated attackers" in its description while its vector asks for low privileges. Plan around the higher figures if your chatflows are public.

How to check if you're exposed

Flowise installs from npm, so start with the version. If you run the packaged server, ask npm directly.

npm ls flowise flowise-components

For a Docker deployment, check the image tag you pulled and compare it with 3.1.3. For source installs, read the version field in the package.json at the repository root. The advisory lists flowise-components at 3.1.2 and earlier as affected and 3.1.3 as patched, so check that package as well as the top level one.

Then look at what your instance exposes. List your chatflows and note which ones use the node named in this CVE, and whether the endpoint for those flows can be reached without a login. The record and the advisory differ on how much authentication is needed, so treat the answer to that question as part of your own risk assessment rather than assuming the lower end of either description.

What to do now

1. Upgrade Flowise, and the flowise-components package, to 3.1.3 or later.
2. Until you can upgrade, take chatflows that use the Airtable Agent node offline or put the Flowise endpoint behind authentication or a VPN.
3. Review who can reach your prediction endpoints. A chatflow that is open to the internet turns prompt input into code execution input.
4. Run Flowise as an unprivileged user in a container with no cloud credentials mounted, so a successful injection has little to take.
5. Check your logs for unexpected Python activity or outbound connections from the Flowise host since you deployed the Airtable Agent node.

Why it matters

The weakness class is code injection (CWE-94). The Airtable Agent node asks a model to produce Python and then runs it. Flowise tried to keep that safe with a validator that checks the code against a blocklist of dangerous patterns. The advisory says that blocklist can be bypassed through obfuscation, and that the code runs in a pyodide environment with no sandbox between it and the host operating system.

Blocklists fail for a simple reason: the defender must name every bad pattern, while the attacker only needs one that was missed. When the thing being filtered is a general purpose language, the list never catches up. The durable fix is to remove the ability to run arbitrary code, or to confine it in a real sandbox. This CVE is one of several that landed in Flowise 3.1.3, so treat the upgrade as covering more than one issue. VulnCheck and the advisory authors describe no exploitation in the wild, and the record's KEV flag is false.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-c5hr-rc98-xp3g
• VulnCheck advisory

Last reviewed: 18 October 2026.