CVE-2026-41265
published 2026-04-23CVE-2026-41265: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.57%
44.9th percentile
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the Airtable_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM generated python script. Using prompt injection techniques, an unauthenticated attacker with the ability to send prompts to a chatflow using the Airtable Agent node may convince an LLM to respond with a malicious python script that executes attacker controlled commands on the flowise server. This vulnerability is fixed in 3.1.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowiseai | flowise | < 3.1.0 | 3.1.0 |
| flowiseai | flowise | >= 0 < 3.1.3 | 3.1.3 |
| flowiseai | flowise-components | >= 0 < 3.1.3 | 3.1.3 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
ghsa·2026-08-04
CVE-2026-69255 [CRITICAL] CWE-94 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
## UPDATE 2026-05-20: Full RCE as root VERIFIED
**This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.**
### Verified Exploit Chain
1. Python code injection via `base64_string = "${base64String}"` (CSVAgent.ts line 161)
2. Pyodide `js` bridge provides access to the host Node.js process
3. `process.mainModule.constructor._load('child_process')` loads child_process (bypasses ESM require restriction)
4. `.execSync('CMD')` executes arbitrary OS commands as **root** (PID 1 in container)
### Working RCE Payload
```
";import js;e=js.globalThis.eval;e("process.mainModule.constructor._load('child_process').execSync('id')");#
```
**Constraint:** No
VulDB
FlowiseAI Flowise up to 3.0.x Airtable_Agents command injection (GHSA-v38x-c887-992f)
vuldb·2026-04-23·CVSS 9.2
CVE-2026-41265 [CRITICAL] FlowiseAI Flowise up to 3.0.x Airtable_Agents command injection (GHSA-v38x-c887-992f)
A vulnerability, which was classified as critical, was found in FlowiseAI Flowise up to 3.0.x. This impacts the function Airtable_Agents. The manipulation results in command injection.
This vulnerability is cataloged as CVE-2026-41265. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-23
Published