CVE-2026-73487: Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows una

Flowise before version 3.1.3 has a security flaw in its CSV and Airtable Agent nodes where a weak code validator (using regex, a pattern-matching tool) can be bypassed to allow prompt injection (tricking the AI by hiding instructions in its input). Attackers without authentication can inject malicious code to steal data, attack internal services, or execute arbitrary code through the prediction API (the interface that makes predictions).