CVE-2026-73485: Flowise: RCE via Airtable Agent pyodide sandbox bypass

Flowise before 3.1.3 lets an unauthenticated attacker execute arbitrary Python on the host by sending a crafted prompt to any chatflow that uses the Airtable Agent node, bypassing the pythonCodeValidator blocklist with simple obfuscation and landing in an unsandboxed pyodide runtime with full OS access. This isn't sandbox-adjacent risk — pyodide here has no isolation at all, so a single crafted message to a public-facing chatflow endpoint is a direct path to host compromise, credential theft, and lateral movement, with no authentication required. Flowise carries 156 other tracked CVEs, so this sits in a package with a demonstrated pattern of weak input validation, and CISA's SSVC decision (TRACK) plus a rated critical severity signal this is worth acting on now even though EPSS (0.28%, ~79th percentile) and KEV status show no evidence of active mass exploitation yet. There is no public exploit or Nuclei template in the wild today, but the blocklist-bypass technique is trivial to reproduce once the advisory is public, so treat the disclosure itself as the trigger. Patch to Flowise 3.1.3+ immediately; if you can't patch now, disable or remove the Airtable Agent node from any internet-facing chatflow and put the Flowise admin/chatflow endpoints behind authentication or network controls until you can.

No confirmed active exploitation of CVE-2026-73485 has been reported, but organizations should still patch proactively.

1) Upgrade to Flowise 3.1.3 or later immediately — this is the primary fix. 2) If immediate patching isn't possible, disable or remove the Airtable Agent node from any chatflow reachable by untrusted or public users. 3) Do not rely on the pythonCodeValidator blocklist as a security boundary going forward — it is bypassable by design; any custom-code agent node should run in a properly isolated sandbox (container, gVisor, microVM) regardless of vendor patching. 4) Restrict network exposure of Flowise chatflow/API endpoints (auth gateway, IP allowlisting, WAF rules for suspicious Python payload patterns in prompt input). 5) Detection: monitor Flowise host processes for unexpected child processes spawned from the Node.js/pyodide runtime, outbound connections not tied to configured integrations, and unusual file system writes outside the app directory. 6) Review Flowise chatflow logs for prompts containing encoded/obfuscated Python constructs (base64, char-code assembly, string concatenation tricks) as a retroactive compromise check.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations, no-code/low-code AI orchestration platforms.

No CVSS score has been assigned yet.