CVE-2026-73487 is a critical (CVSS 9.8) validator bypass in the CSV and Airtable Agent nodes of Flowise before 3.1.3. Prompt injection through the unauthenticated prediction API can leak datasets, reach internal services, and potentially run code. Upgrade flowise and flowise-components to 3.1.3.
What's affected
Flowise through 3.1.2 and the flowise-components package, with 3.1.3 as the patched release, according to the GitHub advisory. Any deployment with a CSV Agent or Airtable Agent chatflow is in scope, and the advisory says no special configuration is needed.
The advisory's own score is 9.3 under CVSS 3.1, a little below the NVD figure of 9.8. Both are critical.
How to check if you're exposed
Check the version.
npm ls flowise flowise-components
Then find chatflows built on the CSV Agent or Airtable Agent nodes and note whether the prediction API for them can be called without authentication. Egress logs from the Flowise host are also useful. Unexpected outbound requests from an agent flow are worth a look.
What to do now
- Upgrade flowise and flowise-components to 3.1.3 or later.
- Disable CSV and Airtable agent flows that do not need to be public until the upgrade is done.
- Restrict outbound network access from the Flowise host to what it needs, which limits data exfiltration and internal requests.
- Require an API key on prediction endpoints.
- Review what data those flows load, and treat anything a public flow could read as exposed if you cannot rule out misuse.
Why it matters
The record maps this to CWE-94, code injection. The advisory shows the underlying mistake: a blocklist of about three dozen patterns that accepts everything it does not recognize. Functions in the pandas library that fetch from a URL were not on the list, so generated code could send data out or request internal addresses without ever using a blocked word.
The lesson is about direction. A blocklist asks what is bad. An allowlist asks what is needed, and for a CSV analysis task the list of needed operations is short. Network egress rules give a second layer that does not depend on the validator being perfect.
It is one of three related Flowise validator issues fixed in 3.1.3, alongside CVE-2026-70470 and CVE-2026-70477. The KEV flag is false.
Prediction APIs and public exposure
The advisory stresses that the unauthenticated prediction API is the way in. Flowise lets you publish chatflows for anyone to talk to, which is the point of many deployments. But a public chat endpoint is also an untrusted input channel for every tool the flow can use. Review which flows are public, and for each one ask what the agent behind it can read and what network it can reach. A flow that analyzes a spreadsheet should not be able to fetch arbitrary URLs.
Data in the flow counts as exposed
The advisory describes sending the loaded dataset to an outside server. So the question after patching is what data your CSV and Airtable flows load. If it includes customer records or internal figures, and the flow was public on 3.1.2 or earlier, consider whether the data may have left. Egress logs from the host, if you keep them, can show outbound requests from the Flowise process to addresses you do not recognize.
The free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project you maintain pulls in an affected package, and the Gold vulnerability directory keeps the record for this CVE.
Quick check
Does egress filtering fix this?
No, the upgrade does. Egress filtering reduces what an attacker can send out or reach while you patch, and it is good practice regardless.
Sources
Last reviewed: 19 October 2026.
