GHSA-v38x-c887-992f: Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

Summary

Flowise 3.0.13, tested on Ubuntu 25.10, has an unauthenticated remote code execution flaw in the run method of the Airtable_Agents class. The method evaluates an LLM-generated Python script in a non-sandboxed environment, and a regex-based check (validatePythonCodeForDataFrame() with FORBIDDEN_PATTERNS) is the only guard before execution. An attacker can run arbitrary code as the user running the server.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Related items

• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer
• HighCVE-2026-110207: Wukong AICRM missing authorization in user and role administration APIsSimilar attack · NVD/CVE Database
• HighCVE-2026-110202: Roo Code command approval bypass via bare >& redirect prefixSimilar attack · NVD/CVE Database