{"data":{"id":"c47090b7-d4d8-449d-bbf6-3b95e326be45","title":"CVE-2026-73485: Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated…","summary":"CVE-2026-73485 affects Flowise before 3.1.3, specifically the Airtable Agent node. An unauthenticated attacker can send crafted prompts to a chatflow using that node, bypassing the pythonCodeValidator blocklist through obfuscation to execute arbitrary Python code. The code runs in an unsandboxed pyodide environment with full access to the host operating system. VulnCheck rates it CVSS 4.0 9.0 CRITICAL, and NVD has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73485","publishedAt":"2026-08-13T12:17:23.807Z","cveId":"CVE-2026-73485","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Flowise","Airtable Agent node"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise code injection in Airtable Agent node via crafted prompts","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00597,"epssCheckedAt":"2026-11-12T15:03:09.941Z","kevDateAdded":null,"advisoryAliases":["GHSA-jqhx-m5fh-f7g2"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T06:14:06.578Z","patchAvailable":null,"disclosureDate":"2026-08-13T12:17:23.807Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}