Input validation error in Flowise - CVE-2026-73485
Published: July 30, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU140059
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73485
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in the run method of the Airtable_Agents class when processing prompts for a chatflow using the Airtable Agent node. A remote user can send a crafted prompt or supply attacker-controlled model output to execute arbitrary code.
Exploitation occurs because validated Python code is executed in an unsandboxed pyodide environment in the context of the user running the server.
Affected software
Flowise
How to mitigate CVE-2026-73485
Install security update from vendor's website.
Flowise - update to 3.1.3