CVE-2026-73486 is a code injection flaw (CWE-94) in the CSV Agent node of Flowise, where the customReadCSV parameter can lead to Python execution. The record rates it High at 8.8 and requires an authenticated user. Flowise 3.1.3 fixes it, so upgrade and limit who can create or edit chatflows.
What's affected
The record says Flowise before 3.1.3 is affected. The GitHub advisory (GHSA-4878-cqgq-j53v) lists the flowise-components npm package at 3.1.2 and earlier as affected, patched in 3.1.3. The reporter tested 3.1.1 on Ubuntu.
This one needs a login. The record vector uses low privileges, and the advisory describes a crafted chatflow with a malicious customReadCSV value, which means the attacker needs to be able to build or modify a flow.
Severity, as two sources state it. The record and the advisory text agree on 8.8 under CVSS 3.1, which is High. VulnCheck lists the same flaw as critical at 9.0 under the newer CVSS 4.0 scale, which also scores impact on connected systems. Use the number that matches how you score internally, and note that the two scales answer slightly different questions.
How to check if you're exposed
Flowise installs from npm, so start with the version. If you run the packaged server, ask npm directly.
npm ls flowise flowise-components
For a Docker deployment, check the image tag you pulled and compare it with 3.1.3. For source installs, read the version field in the package.json at the repository root. The advisory lists flowise-components at 3.1.2 and earlier as affected and 3.1.3 as patched, so check that package as well as the top level one.
Then look at what your instance exposes. List your chatflows and note which ones use the CSV Agent node, and whether the endpoint for those flows can be reached without a login. The record and the advisory differ on how much authentication is needed, so treat the answer to that question as part of your own risk assessment rather than assuming the lower end of either description.
Also list the accounts that can create or edit chatflows. For this CVE, that population is your exposure.
What to do now
- Upgrade Flowise and
flowise-componentsto 3.1.3 or later. - Audit the user list. Remove accounts that no longer need flow building rights, and rotate shared credentials.
- Review existing chatflows that use the CSV Agent node and look for a customReadCSV value you do not recognise.
- Run the Flowise process with the fewest privileges possible and keep cloud and database secrets out of its environment.
- Add the Flowise version to your inventory so the next advisory is a lookup, not a hunt.
Why it matters
This is the same weakness family as the Airtable Agent issue, CWE-94. The customReadCSV parameter lets a flow author supply Python, and Flowise checks it with a static regular expression blocklist. The advisory says that blocklist can be bypassed by obfuscation, so the supplied code reaches an unsandboxed pyodide runtime with full access to the host system.
A regular expression is a poor tool for judging code, because there are endless ways to write the same behaviour. The pattern repeats across AI agent builders: a feature that lets users supply a snippet gets protected by a filter instead of an isolation boundary. When you review any agent platform, ask where untrusted text turns into running code and what stands between that code and the host. KEV status is false for this record.
Quick check
Do I need to worry if only staff use Flowise?
Yes, to a lesser degree. The attack needs a login, so a stolen or shared staff account is enough. Upgrade and trim who can edit flows.
Is the CSV Agent node the only one affected?
This CVE covers the CSV Agent node. The same release also fixes the Airtable Agent and Custom MCP issues, which have their own CVE ids.
Sources
Last reviewed: 18 October 2026.
