External risk intelligence

Flowise Airtable Agent Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-73485

Flowise is a low-code platform commonly deployed as a web-based application to provide public or internal chatflow interfaces, APIs, and AI agent services. As a web service designed to facilitate user interaction with AI workflows, it is frequently exposed to the internet or wide internal networks to function as a gateway for end-user prompts and LLM interactions.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical code injection vulnerability discovered in Flowise, a platform used for building AI chatflows and agents. The vulnerability allows attackers to bypass security measures and execute arbitrary Python code on the host system, potentially leading to unauthorized access and control.

Unauthenticated attackers can run their own code.
It affects platforms that interact with users via AI agents.
Confirm relevance and exposure to maintain system integrity.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted prompts to a chatflow that uses the Airtable Agent node. This allows them to bypass security checks and inject malicious Python code, which then runs with full system access in an unsandboxed environment.

No authentication required.
Bypassing code validation with obfuscation.
Arbitrary Python code execution on host.

Live Threat

Current exploitation, exposure, and threat context

The Airtable Agent node in Flowise could allow unauthenticated attackers to execute arbitrary Python code. This could happen when crafted prompts are sent to a chatflow using this node, potentially leading to the compromise of the host operating system.

System data could be at risk.
Arbitrary Python code execution.
Host system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Flowise's Airtable Agent node necessitates immediate attention from platform or application owners responsible for managing AI workflows and data integrations. The first practical step is to identify all deployments of Flowise, determine their network exposure and business criticality, and locate the accountable technical owner. Subsequently, a risk-based remediation plan, including potential vendor coordination for updates, should be developed and executed.

Platform and application owners to lead.
Verify Airtable Agent node usage.
Plan risk-based remediation strategy.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise and what is it used for?

Flowise is a low-code platform designed to help developers and teams build AI-powered chatflows, agents, and custom workflows. Users leverage its visual interface to connect various data sources and AI tools, creating web-based interfaces or APIs that process user prompts. Because it acts as a central hub for AI interactions, it is commonly deployed as a service where it can communicate with internal systems or be accessed by end users via the internet.

What does this code injection vulnerability mean?

This vulnerability is classified as CWE-94: Improper Control of Generation of Code. In this specific case, the Airtable Agent component in Flowise contains a flaw where its security filters can be tricked by obfuscated inputs. Because the underlying environment that executes these scripts is not properly sandboxed, a successful bypass allows an attacker to run their own unauthorized Python commands directly on the server hosting the application.

How do attackers trigger this vulnerability?

An attacker triggers this by interacting with a chatflow that utilizes the Airtable Agent node. By sending specially crafted prompts designed to bypass the platform's blocklist, they can force the system to accept and execute malicious Python code. This vulnerability does not require authentication; however, it only occurs when the specific Airtable Agent node is configured and active within a running chatflow. Simply having the software installed without this active node prevents this specific path.

Is my Flowise instance at risk?

According to Halo Surface Signal, Flowise is often deployed as a web-based application intended to be reachable by users, making internet-facing instances particularly relevant. If your instance is accessible over the internet or a wide internal network to facilitate AI agent interactions, it may be exposed to these crafted prompts. You should prioritize assessing any instance that acts as a public or wide-access gateway for your AI services.

What should I do if I run Flowise?

Begin by auditing your current deployments to identify which chatflows are actively using the Airtable Agent node. Once identified, document the network accessibility and business criticality of those specific services. Review vendor security updates to move to a version where this node is secured. If you cannot update immediately, consider restricting access to the affected workflows or disabling the Airtable Agent node until a verified fix is implemented.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.