# CVE-2026-41138: Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.

Source: https://junglewise.ai/threats/cve-2026-41138-flowise-remote-code-execution-vulnerability-in-airtableagent-ts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41138 · Severity: high · CVSS 8.8 · Published 2026-04-23

Flowise is a low-code platform that allows users to build AI applications with Airtable data integration. The AirtableAgent component executes Python code to query Airtable datasets, but fails to sanitize user input before passing it to a language model for code generation. An attacker can inject malicious prompts to trick the LLM into generating harmful Python code that executes with full system privileges, enabling remote code execution.

Technologies: [FlowiseAI Flowise](https://junglewise.ai/threats/technologies/flowiseai-flowise), [flowise (npm)](https://junglewise.ai/threats/technologies/flowise), [flowise-components (npm)](https://junglewise.ai/threats/technologies/flowise-components). Vendors: [FlowiseAI](https://junglewise.ai/threats/vendors/flowiseai), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41138 being exploited in the wild.

**How severe is CVE-2026-41138?** High severity, with a CVSS score of 8.8, published 23 April 2026.

**Which products and versions are affected?** flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0; flowise-components (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.

**Is there a fix for CVE-2026-41138?** Yes. flowise (npm): upgrade to 3.1.0 or later; flowise-components (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41138 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41138?** Check whether you run FlowiseAI Flowise, flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flowise (npm): upgrade to 3.1.0 or later

  ```sh
  npm install flowise@3.1.0
  ```

- flowise-components (npm): upgrade to 3.1.0 or later

  ```sh
  npm install flowise-components@3.1.0
  ```


## Technical details

This vulnerability is a prompt injection flaw in the AirtableAgent component. User input is concatenated directly into a prompt template without sanitization, then passed to an LLM (via LLMChain) to generate Python code. The LLM's output is executed unsanitized by Pyodide without any validation. An attacker can craft a prompt that breaks out of the intended data-query context and instructs the LLM to generate arbitrary Python code. The attack requires network access and the ability to send prompts to an active Flowise chatflow with AirtableAgent enabled, but no authentication is typically required for chatflow interaction. The vulnerability affects Flowise versions up to 3.0.13, with patches available in version 3.1.0 for both the flowise and flowise-components packages.

## Affected products

- FlowiseAI Flowise <=3.0.13
- FlowiseAI flowise-components <=3.0.13

## Identifiers

- CVE-2026-41138
- GHSA-f228-chmx-v6j6

## Timeline

- 2026-04-15: disclosed: Advisory published on GitHub
- 2026-04-16: patched: Fix released in version 3.1.0

## References

- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f228-chmx-v6j6](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f228-chmx-v6j6)

## Related threats

- [Flowise sandbox escape in custom function endpoint](https://junglewise.ai/threats/cve-2026-119978-flowise-through-3-1-4-contains-a-sandbox-escape-vulnerability)
- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Flowise credential lookup authorization bypass](https://junglewise.ai/threats/cve-2026-100609-flowise-npm-packages-flowise-and-flowise-components-through-3-1)
- [Flowise authentication bypass via email-only SSO matching](https://junglewise.ai/threats/cve-2026-100607-flowise-through-3-1-4-resolves-sso-and-local-password-users)
- [Flowise authentication bypass in SSO login path](https://junglewise.ai/threats/cve-2026-100606-flowise-through-3-1-4-enterprise-platform-mode-with-sso-enabled)