CVE-2026-41265: Flowise command execution via prompt injection in Airtable Agent node

Summary

CVE-2026-41265 affects Flowise versions prior to 3.1.0. The flaw sits in the run method of the Airtable_Agents class, which evaluates an LLM-generated Python script without proper sandboxing. An unauthenticated attacker who can send prompts to a chatflow using the Airtable Agent node can use prompt injection to make the LLM return a malicious script, which then runs attacker-controlled commands on the Flowise server.

Mitigation

Fixed in 3.1.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database