Flowise CVE-2026-73485

Requires a reachable Flowise chatflow (version < 3.1.3) that includes the Airtable Agent node and accepts prompts, plus a Python payload obfuscated to bypass the pythonCodeValidator blocklist. The description states the attack is unauthenticated, so an internet-exposed prediction endpoint with no auth is the worst case; however, the official CVSS vector's PR:L implies some privilege may be needed - verify whether your instance enforces authentication. Limiting factors: the target must actually use the Airtable Agent node (not a default component for every deployment), the attacker must craft an obfuscation that defeats the validator (vendor rates this AC:H), and instances behind authentication or network restrictions are substantially harder to reach.

This is a genuine high-priority issue: unauthenticated (per description) network-reachable RCE with full host impact (VC:H/VI:H/VA:H and subsequent-system SC/SI/SA:H), landing at CVSS 4.0 base 9.0. The vendor vector tempers this with AC:H and PR:L, implying meaningful crafting effort and some privilege - but the description explicitly states unauthenticated exploitation and blocklist bypass, which conflicts with PR:L and, once a working obfuscation is public, undercuts AC:H (the bypass becomes reusable/scriptable). No EPSS score, KEV entry, SSVC decision, or public POC was provided, so probability-of-exploitation signals are absent; the raw impact and the low barrier of a denylist bypass should drive prioritization rather than the missing EPSS. Net: treat as urgent for any internet-exposed Flowise instance, while noting the auth requirement is the single most important item to verify against your deployment.

An attacker discovers an internet-exposed Flowise chatflow that wires in the Airtable Agent node and submits a prompt containing Python obfuscated to evade the pythonCodeValidator blocklist. The reconstructed payload executes in the unsandboxed pyodide runtime, giving the attacker command execution as the Flowise process and a foothold on the host. No public POC is identified at time of analysis, but the technique is described in enough detail to be reproducible by a skilled attacker.