External risk intelligence

Flowise Agent Nodes Prompt Injection Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-73487

Flowise is a low-code platform for building AI agents and LLM flows that is commonly deployed as a web-based service or API endpoint to facilitate user and application interaction. Because the vulnerability exists within the application's prediction API and nodes accessible through its interface, it is commonly exposed as an internet-facing web service in real-world deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Flowise, a tool used for building AI agents and workflows. It allows unauthenticated attackers to potentially inject malicious code, leading to data exfiltration, internal system access, or code execution. The main concern is to confirm if this technology is in use and if it is exposed externally.

Code injection via AI agent nodes.
Affects data, internal systems, and execution.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

Attackers can exploit prompt injection in Flowise's CSV and Airtable Agent nodes to bypass code validation. This allows them to inject malicious code, potentially leading to data exfiltration, server-side request forgery, or code execution.

No authentication required.
Malicious prompts submitted to agent nodes.
Unauthorized code execution and data theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system data and service behavior when user interactions are processed. Attackers may be able to access datasets, interact with internal services, or execute code.

Datasets and internal services at risk.
Malicious code injection via prompt.
Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Flowise deployments, likely application owners or platform engineering, must first identify all instances of the affected technology. Confirming exposure, business criticality, and accountable owners will allow for risk-based remediation planning.

Application owners should manage this issue.
Verify external exposure and critical assets.
Plan remediation within maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a low-code software platform designed for building AI agents and complex workflows. It allows developers to visually connect Large Language Models (LLMs) with various data sources and tools, such as CSV files or Airtable, often deploying them as web-based services or APIs to handle user interactions.

What is the vulnerability in CVE-2026-73487?

This vulnerability is an instance of Improper Control of Generation of Code (CWE-94). It occurs because the software fails to properly validate Python code within certain agent nodes. An attacker can bypass these security checks to run unauthorized commands or functions, turning a standard AI prompt into a vehicle for executing unintended malicious code.

How do attackers trigger this vulnerability?

Attackers trigger this by submitting a crafted, malicious prompt through the application's prediction API. The vulnerability specifically affects CSV and Airtable Agent nodes. It is important to note that simply visiting the platform's user interface is not enough; the attack requires sending input that interacts with these specific, improperly validated processing nodes.

Is my Flowise instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your instance is internet-facing, as it acts as an API endpoint for user and application interactions. Because the attack does not require prior authentication, any Flowise deployment exposed to the public internet is at a higher risk of being targeted by unauthorized external actors.

What should I do if I use Flowise?

First, locate all instances of Flowise within your environment and confirm their network exposure. Prioritize internal review of any services accessible from the internet. Once identified, follow your standard patch management process to update to a version beyond 3.1.3, which contains the necessary security fixes for these agent nodes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.