# CVE-2026-73485: Flowise Airtable Agent code injection in pyodide

Source: https://junglewise.ai/threats/cve-2026-73485-flowise-airtable-agent-code-injection-in-pyodide  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73485 · Severity: high · CVSS 8.8 · Published 2026-08-13

Flowise is an open-source low-code platform for building conversational AI applications. The Airtable Agent node allows users to query Airtable data through a chatbot interface. A vulnerability in this node allows unauthenticated attackers to inject and execute arbitrary Python code by crafting malicious prompts, leading to full remote code execution on the server with the privileges of the running process.

## Quick answers

**Is CVE-2026-73485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73485 being exploited in the wild.

**How severe is CVE-2026-73485?** High severity, with a CVSS score of 8.8, published 13 August 2026.

**Which products and versions are affected?** Flowise Flowise before 3.1.3.

**Is there a fix for CVE-2026-73485?** A patch was published on 2026-08-13: Version 3.1.3 released with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73485 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73485?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a code injection vulnerability (CWE-94) in the Airtable Agent's run method. The vulnerability exists because LLM-generated Python code is validated using a regex-based blocklist (pythonCodeValidator) before execution in pyodide, but the blocklist can be bypassed through multiple obfuscation techniques including string concatenation, chr() encoding, decorator syntax, and frame inspection. Additionally, pyodide is not sandboxed and has full access to OS interfaces. Unauthenticated attackers can exploit this by sending crafted prompts that cause the LLM to generate obfuscated malicious Python code, while authenticated attackers can configure malicious Airtable tables or servers. No authentication is required for exploitation via prompt injection.

## Affected products

- Flowise Flowise before 3.1.3

## Timeline

- 2026-07-29: disclosed: GitHub Security Advisory GHSA-c5hr-rc98-xp3g published
- 2026-08-13: advisory: CVE-2026-73485 published on NVD
- 2026-08-13: patched: Version 3.1.3 released with patch

## References

- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c5hr-rc98-xp3g](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c5hr-rc98-xp3g)
- [https://www.vulncheck.com/advisories/flowise-before-remote-code-execution-via-airtable-agent](https://www.vulncheck.com/advisories/flowise-before-remote-code-execution-via-airtable-agent)