Loading vulnerability…
Flowise Airtable Agent Prompt Injection to Python RCE
CVE-2026-41265 is a remote code execution vulnerability in Flowise affecting versions prior to 3.1.0. The flaw is located in the run method of the Airtable_Agents class, where an LLM-generated Python script is evaluated without proper sandboxing and with insufficient validation of attacker-influenced input. In deployments that expose a chatflow using the Airtable Agent node, an unauthenticated attacker can use prompt injection to influence the model into producing a malicious Python script. That script is then executed by the application, allowing attacker-controlled commands to run on the Flowise server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the affected Flowise host in the context of the Flowise service account. This can result in full compromise of the application environment, including unauthorized access to data handled by the service, modification of application state or workflows, and disruption of service availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or removing chatflows that use the Airtable Agent node, restricting unauthenticated access to affected chatflows, and limiting which users or systems can submit prompts to those flows. Additional defensive measures include isolating the Flowise service, minimizing service account privileges, and constraining execution environments so that any unintended script execution has reduced impact. These measures are temporary risk-reduction steps and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.0 or later, which fixes the Airtable Agent vulnerability. Any deployment running a version prior to 3.1.0 should be updated as the primary remediation measure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.