Loading vulnerability…
Remote Code Execution in Flowise AirtableAgent.ts
CVE-2026-41138 is a remote code execution vulnerability in Flowise affecting versions prior to 3.1.0. The flaw is located in AirtableAgent.ts when using Pandas. According to the provided advisory text, user-supplied input is inserted directly into the question parameter of a prompt template and is then reflected into generated or executed Python code without sanitization or sufficient input verification. This unsafe handling of attacker-controlled input can allow malicious input to alter the resulting Python code path and achieve code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution in the context of the vulnerable Flowise deployment. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) indicates network-reachable exploitation with low attack complexity, requiring low privileges and no user interaction. Impact includes high confidentiality and integrity compromise, with low availability impact, meaning an attacker may read sensitive data accessible to the service, modify data or application behavior, and potentially disrupt service operation to a limited extent.
If you can’t patch tonight, do this now.
As a temporary mitigation, restrict access to vulnerable Flowise instances and limit which users can invoke affected Airtable/Pandas functionality, since the CVSS data indicates low privileges are required. Disable or avoid workflows that pass user-controlled input into the vulnerable question parameter path in AirtableAgent.ts. Apply strict input validation and sanitization around any user-supplied values that may be reflected into Python execution contexts, and monitor for suspicious prompt inputs or unexpected Python execution behavior until the product is upgraded.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.0 or later, as the vulnerability is fixed in 3.1.0 according to the provided advisory. If upgrading is not immediately possible, review any use of AirtableAgent.ts with Pandas-backed functionality and remove or disable vulnerable workflows until the fixed release can be deployed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.