CVE-2026-73487: Flowise Python sandbox bypass

Q: Is CVE-2026-73487 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-73487, increasing the risk of exploitation.

Q: How to fix CVE-2026-73487?

Upgrade to Flowise 3.1.3 or later, which fixes the code validator bypass. If immediate patching isn't possible: (1) place the Flowise prediction API behind authentication/network restrictions — it should never be internet-facing without a gateway; (2) disable or remove CSV Agent and Airtable Agent nodes from production flows until patched; (3) restrict outbound network access from the Flowise host to prevent SSRF pivoting; (4) monitor logs for unexpected pandas I/O calls (read_json, read_html, read_pickle) or unusual outbound connections originating from agent execution; (5) review any Flowise flow definitions for CSV/Airtable nodes accepting untrusted input and audit associated data access scope.

Q: What systems are affected by CVE-2026-73487?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration platforms, data ingestion pipelines.

Q: What is the CVSS score for CVE-2026-73487?

No CVSS score has been assigned yet.

CISO Take

Flowise's CSV and Airtable Agent nodes rely on a regex-based validator to block dangerous Python calls, but that validator can be bypassed by routing execution through unblocked pandas functions like pd.read_json(), letting an attacker turn a prompt injection into dataset exfiltration, SSRF against internal services, or full code execution — all without authentication, since the prediction API is exposed by default. This isn't yet in CISA KEV and EPSS sits at 0.39% (though in the top 68th percentile of scored CVEs), so mass exploitation isn't observed today, but CISA's own SSVC decision is ATTEND and the bug requires no credentials, no user interaction, and no public exploit code to weaponize — just knowledge of pandas' I/O surface. Any org running Flowise-based agents that ingest CSV or Airtable data should treat this as a live perimeter risk, not a theoretical one, because the attack path (data ingestion node → agent → shell) is exactly the pattern low-code AI orchestration tools are built around. Patch to Flowise 3.1.3 or later immediately; until then, take the prediction API off the public internet (auth proxy or network ACL), disable or gate CSV/Airtable Agent nodes, and monitor for anomalous outbound requests or pandas subprocess/file-read activity originating from the Flowise host.

Sources:NVDGitHub AdvisoryEPSSATLASvulncheck.com

What is the risk?

Critical in practice despite the absence of a published CVSS score: the vulnerability requires no authentication, no user interaction, and targets an agent framework whose entire value proposition is ingesting untrusted external data (CSV uploads, Airtable records) directly into LLM-orchestrated code paths. Exploitability is currently constrained by the lack of a public PoC or Nuclei template and a low absolute EPSS score (0.39%), which is why CISA's SSVC lands on ATTEND rather than ACT — but the bar to exploit is a crafted prompt/payload against a pandas sandbox escape, well within reach of a moderately skilled attacker with AI/ML tooling familiarity. Impact is high: code execution on the host running the agent, SSRF pivoting into internal networks, and exfiltration of any dataset the agent has access to.

How does the attack unfold?

Initial Access

Attacker sends a crafted request to Flowise's unauthenticated prediction API targeting a flow with a CSV or Airtable Agent node.

AML.T0049

Validator Bypass

The payload evades the regex-based Python code validator by invoking an unblocked pandas function instead of a blocklisted keyword.

AML.T0051

Code Execution / SSRF

pd.read_json() or a similar function is executed in the agent's Python context, enabling arbitrary file reads or outbound requests to internal services.

AML.T0053

Impact

Attacker exfiltrates datasets accessible to the agent or pivots via SSRF into internal network resources.

AML.T0086

Initial Access

Attacker sends a crafted request to Flowise's unauthenticated prediction API targeting a flow with a CSV or Airtable Agent node.

AML.T0049

Validator Bypass

The payload evades the regex-based Python code validator by invoking an unblocked pandas function instead of a blocklisted keyword.

AML.T0051

Code Execution / SSRF

pd.read_json() or a similar function is executed in the agent's Python context, enabling arbitrary file reads or outbound requests to internal services.

AML.T0053

Impact

Attacker exfiltrates datasets accessible to the agent or pivots via SSRF into internal network resources.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

1.0%

chance of exploitation in 30 days

Higher than 62% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade to Flowise 3.1.3 or later, which fixes the code validator bypass. If immediate patching isn't possible: (1) place the Flowise prediction API behind authentication/network restrictions — it should never be internet-facing without a gateway; (2) disable or remove CSV Agent and Airtable Agent nodes from production flows until patched; (3) restrict outbound network access from the Flowise host to prevent SSRF pivoting; (4) monitor logs for unexpected pandas I/O calls (read_json, read_html, read_pickle) or unusual outbound connections originating from agent execution; (5) review any Flowise flow definitions for CSV/Airtable nodes accepting untrusted input and audit associated data access scope.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt InjectionCode ExecutionData ExtractionAgentFrameworkAML.T0049- Exploit Public-Facing Application AML.T0051- LLM Prompt Injection AML.T0053- AI Agent Tool Invocation AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6-AI system operation and monitoring

OWASP LLM Top 10

LLM01-Prompt InjectionLLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2026-73487?

Flowise's CSV and Airtable Agent nodes rely on a regex-based validator to block dangerous Python calls, but that validator can be bypassed by routing execution through unblocked pandas functions like pd.read_json(), letting an attacker turn a prompt injection into dataset exfiltration, SSRF against internal services, or full code execution — all without authentication, since the prediction API is exposed by default. This isn't yet in CISA KEV and EPSS sits at 0.39% (though in the top 68th percentile of scored CVEs), so mass exploitation isn't observed today, but CISA's own SSVC decision is ATTEND and the bug requires no credentials, no user interaction, and no public exploit code to weaponize — just knowledge of pandas' I/O surface. Any org running Flowise-based agents that ingest CSV or Airtable data should treat this as a live perimeter risk, not a theoretical one, because the attack path (data ingestion node → agent → shell) is exactly the pattern low-code AI orchestration tools are built around. Patch to Flowise 3.1.3 or later immediately; until then, take the prediction API off the public internet (auth proxy or network ACL), disable or gate CSV/Airtable Agent nodes, and monitor for anomalous outbound requests or pandas subprocess/file-read activity originating from the Flowise host.

Is CVE-2026-73487 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-73487, increasing the risk of exploitation.

How to fix CVE-2026-73487?

Upgrade to Flowise 3.1.3 or later, which fixes the code validator bypass. If immediate patching isn't possible: (1) place the Flowise prediction API behind authentication/network restrictions — it should never be internet-facing without a gateway; (2) disable or remove CSV Agent and Airtable Agent nodes from production flows until patched; (3) restrict outbound network access from the Flowise host to prevent SSRF pivoting; (4) monitor logs for unexpected pandas I/O calls (read_json, read_html, read_pickle) or unusual outbound connections originating from agent execution; (5) review any Flowise flow definitions for CSV/Airtable nodes accepting untrusted input and audit associated data access scope.

What systems are affected by CVE-2026-73487?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration platforms, data ingestion pipelines.

What is the CVSS score for CVE-2026-73487?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI orchestration platformsdata ingestion pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0051LLM Prompt Injection

AML.T0053AI Agent Tool Invocation

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

OWASP LLM Top 10: LLM01, LLM08

What are the technical details?

Original Advisory

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.

Exploitation Scenario

An unauthenticated attacker submits a crafted input to Flowise's public prediction API targeting a flow that uses the CSV or Airtable Agent node. The payload is designed to pass the regex-based Python validator by avoiding blocklisted keywords while still invoking pd.read_json() or a similar unblocked pandas function. Once executed inside the agent's Python evaluation context, the attacker uses that function to read arbitrary local files (dataset exfiltration), issue outbound HTTP requests to internal-only services (SSRF), or chain further pandas/IO calls to achieve broader code execution on the host — all through a single unauthenticated API call with no prior access to the system.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.