Flowise CVE-2026-73487

Exploitation requires that the target Flowise deployment (before 3.1.3) expose a flow using the CSV Agent or Airtable Agent node reachable through the prediction API, and that this API be network-accessible without authentication (PR:N per the CVSS vector). The concrete prerequisite is prompt-injection control over the agent's input plus a payload that invokes an unblocked pandas function such as pd.read_json() to slip past the regex validator. Limiting factors: the attack is rated high complexity (AC:H) because it hinges on reliably manipulating the LLM and defeating the blocklist; instances that do not use these specific agent nodes, that gate the prediction API behind authentication, or that are not network-exposed are not practically exploitable.

The CVSS 4.0 base score is 9.0 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N): network-reachable and unauthenticated (PR:N) with high impact to confidentiality of both the vulnerable system and downstream/internal systems (SC:H, reflecting SSRF), but rated high attack complexity (AC:H) because the attacker must reliably steer the LLM and craft payloads that survive the regex validator. That AC:H and the multi-step, model-mediated exploitation path temper the raw severity: this is not a single deterministic request but a prompt-injection-dependent chain, so real-world reliability varies by model and node configuration. No EPSS score, KEV entry, or public POC was provided, so exploitation appears theoretical/reported rather than observed in the wild - treat as a high-priority patch for any internet-exposed Flowise instance that uses the CSV or Airtable Agent nodes, but not an emergency on par with a mass-exploited KEV item. Note the exploitation is contingent on those specific agent nodes being deployed and reachable.

An attacker submits a crafted query to an internet-exposed Flowise instance's unauthenticated prediction API targeting a CSV or Airtable Agent flow, using prompt injection to make the underlying LLM emit Python that calls an unblocked function like pd.read_json('http://169.254.169.254/...') or a local file path. Because the regex validator does not block this call, Flowise executes it, letting the attacker reach internal services (SSRF), read local datasets, or escalate to code execution. No public POC was provided, and success depends on reliably steering the model past the validator (AC:H).