Input validation error in Flowise - #VU140059
Published: July 30, 2026
Vulnerability identifier: #VU140059
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in the run method of the Airtable_Agents class when processing prompts for a chatflow using the Airtable Agent node. A remote user can send a crafted prompt or supply attacker-controlled model output to execute arbitrary code.
Exploitation occurs because validated Python code is executed in an unsandboxed pyodide environment in the context of the user running the server.
Affected software
Flowise
Remediation
Install security update from vendor's website.
Flowise - update to 3.1.3