Code injection remote code execution in Flowise Airtable Agent node (CVE-2026-73485)

Flowise contains a code injection vulnerability in the run method of the Airtable_Agents class, where user-supplied prompts can cause the application to execute attacker-controlled Python code in an unsandboxed pyodide environment. The pythonCodeValidator blocklist can be bypassed via obfuscation techniques including string concatenation, chr() encoding, aliasing, MRO traversal, and decorator syntax, allowing unauthenticated remote attackers to execute arbitrary code with the privileges of the server process. Affected versions: - <= 3.1.2 We recommend updating to: 3.1.3. CVSS 9.0 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c5hr-rc98-xp3g Details: https://vuln.today/cve/CVE-2026-73485