What is the CVSS score of CVE-2026-41138?

CVE-2026-41138 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Flowise are affected by CVE-2026-41138?

FlowiseAI Flowise versions before 3.1.0 contain a critical remote code execution vulnerability in the AirtableAgent node that publicly available exploit code demonstrates can be abused through prompt…. A patch is available.

How to fix or mitigate CVE-2026-41138?

Within 24 hours, identify all systems running FlowiseAI Flowise and determine which instances are running versions prior to 3.1.0, paying particular attention to any internet-facing or customer-accessible deployments. Within 7 days, upgrade all affected Flowise instances to vendor-released patch version 3.1.0 or later, testing the upgrade in a staging environment before production deployment to ensure compatibility with existing workflows. Within 30 days, review access logs and execution history on all Flowise instances for evidence of exploitation, implement network-level access controls restricting Flowise to trusted internal networks only, and establish a process for tracking and applying security updates to Flowise going forward.

Flowise CVE-2026-41138

EUVD-2026-25278 HIGH

Code Injection (CWE-94)

2026-04-23 GitHub_M

GHSA-f228-chmx-v6j6

RCE Python Code Injection Flowise Flowiseai

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable chatflow with low-complexity prompt injection, but PR:L since instance/chatflow access is needed; code execution yields high C/I/A within the runtime.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:34 vuln.today

Analysis Generated

Jul 24, 2026 - 04:34 vuln.today

Patch released

Apr 24, 2026 - 19:17 nvd

Patch available

CVSS changed

Apr 24, 2026 - 15:22 NVD

8.3 (HIGH) 8.8 (HIGH)

Patch available

Apr 23, 2026 - 21:01 EUVD

EUVD ID Assigned

Apr 23, 2026 - 20:00 euvd

EUVD-2026-25278

CVE Published

Apr 23, 2026 - 19:05 nvd

HIGH 8.8

DescriptionGitHub Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input is directly applied to the question parameter within the prompt template and it is reflected to the Python code without any sanitization. This vulnerability is fixed in 3.1.0.

AnalysisAI

Remote code execution in FlowiseAI Flowise before 3.1.0 allows an attacker to abuse the AirtableAgent node, which passes unsanitized user question input into a Python code template executed via Pyodide/Pandas. Because the question is reflected directly into the generated Python without validation, a crafted prompt-injection payload escapes the intended LLM behavior and executes arbitrary Python. SSVC rates technical impact as total with a public proof-of-concept, though EPSS remains low at 0.43% (63rd percentile) and there is no public exploit identified in CISA KEV at time of analysis.

Technical ContextAI

Flowise is a low-code drag-and-drop builder for LLM/agent workflows. The vulnerable component is the AirtableAgent node (packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts), which retrieves Airtable datasets, base64-encodes them, and processes them with Pandas inside a Pyodide (WebAssembly Python) runtime via pyodide.runPythonAsync(). The user's natural-language question is interpolated into a prompt template and ultimately reflected into the executed Python source string without sanitization or parameterization. This is a classic CWE-94 (Improper Control of Generation of Code / code injection) root cause: untrusted input crossing into a dynamically constructed code context. The prompt-injection angle means the LLM can be steered to emit attacker-chosen Python that the runtime then executes.

RemediationAI

Vendor-released patch: upgrade Flowise (and flowise-components) to 3.1.0 or later, which adds input verification for the AirtableAgent Pandas path. Until upgrading, the most effective compensating control is to remove or disable any chatflows using the AirtableAgent node, since that node is the injection sink; the trade-off is loss of Airtable-agent functionality. Additionally restrict who can create/invoke chatflows and reach the instance (enforce authentication and network access controls on the Flowise API/UI), which reduces the PR:L attacker pool but does not fix the underlying code injection. Review the vendor advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f228-chmx-v6j6 for exact fixed versions before deploying.