Executive brief
Flowise is an open-source low-code platform for building AI applications and chatbots with LLM integration. An unauthenticated attacker can exploit a prompt injection vulnerability in the Airtable Agent node to execute arbitrary code on the Flowise server, potentially compromising the entire system and any data it processes.
Technical details
The vulnerability exists in the Airtable_Agents class's run method, which accepts LLM-generated Python code without proper sandboxing. Although the code includes a validatePythonCodeForDataFrame() function that checks for forbidden patterns (imports, exec, eval, os operations), the regex-based validation can be bypassed using techniques such as aliasing restricted modules (e.g., `import os as pandas`). An unauthenticated attacker can send a crafted prompt to a chatflow using the Airtable Agent node, inducing the LLM to generate malicious Python code that bypasses the filter. This code is then executed with the privileges of the Flowise server process, allowing arbitrary code execution. Affected versions through 3.0.13 are vulnerable; patch released in version 3.1.0.
Affected products
- FlowiseAI Flowise <= 3.0.13
- FlowiseAI flowise-components <= 3.0.13
Timeline
- 2026-04-15: disclosed
- 2026-04-18: patched: Version 3.1.0 released
- 2026-04-18: advisory