Input validation error in Flowise - CVE-2026-73486
Published: July 30, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU140060
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73486
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper input validation in the run method of the CSV_Agents class when processing a crafted chatflow using a CSV Agent node with a malicious customReadCSV value. A remote user can send a crafted chatflow and trigger internal prediction to execute arbitrary code.
Python code executes in an unsandboxed pyodide environment in the context of the user running the server.
Affected software
Flowise
How to mitigate CVE-2026-73486
Install security update from vendor's website.
Flowise - update to 3.1.3