Prompt injection to RCE and SSRF via Python validator bypass in Flowise (CVE-2026-73487)

Flowise CSV Agent and Airtable Agent nodes use a regex-based blocklist to validate LLM-generated Python code before execution in Pyodide. The blocklist has multiple structural bypasses - most critically, pandas URL-fetching functions such as pd.read_json() are not blocked - allowing an unauthenticated attacker to inject malicious code via the prediction API and exfiltrate loaded datasets, perform SSRF against internal services, or achieve further code execution. Affected versions: - <= 3.1.2 We recommend updating to: 3.1.3. CVSS 9.0 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg Details: https://vuln.today/cve/CVE-2026-73487