Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73487Flowise before 3.1.3 Prompt Injection RCE via CSV Agent

Critical 9.0

In plain English

A critical-severity code injection in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.0Critical

Exploit odds (30 days)1.0%top 38.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.1.3	GHSA-w7x8-q2gp-5cgg
npm	flowise-components	3.1.3	GHSA-w7x8-q2gp-5cgg

Affected products (as reported)

Vendor	Product	Versions
FlowiseAI	Flowise	0 – before 3.1.3
FlowiseAI	Flowise	0 – before 3.1.3

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

References

GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) vendor-advisory
VulnCheck Advisory: Flowise before 3.1.3 Prompt Injection RCE via CSV Agent third-party-advisory