CVE-2026-73487

Executive Summary

CVE-2026-73487 is an unauthenticated code injection vulnerability affecting Flowise versions before 3.1.3. The flaw exists in the regex-based Python code validator implemented in the CSV and Airtable Agent nodes, where prompt injection can cause malicious Python to bypass validation and execute through the unauthenticated prediction API. Successful exploitation can lead to dataset exfiltration, server-side request forgery (SSRF) against internal services, or full remote code execution.

Technical Analysis

Flowise is an open-source platform for building LLM-based agent workflows. The affected components are the CSV Agent node and the Airtable Agent node. These node types allow the underlying language model to generate Python code to process tabular or structured data. Before the model-generated code is executed, Flowise applies a validation layer intended to block dangerous Python constructs. According to the NVD description, that validation is implemented as a regex-based checker.

Regex-based code validators are inherently fragile because they rely on exact pattern matching rather than semantic analysis. Attackers can craft prompt-injection payloads that cause the LLM to produce syntactically valid and behaviorally dangerous Python while avoiding the exact literal strings the validator blocks. The NVD description specifically names pd.read_json() as an example of an unblocked pandas method. Because the validator does not restrict this class of pandas functions, an attacker can instruct the agent to invoke pd.read_json() on attacker-controlled input, such as a URL or local file path.

The execution context is a Flowise agent runtime exposed through the “prediction API”. The NVD description states this API is unauthenticated, meaning no valid session, token, or API key is required to submit a malicious prompt. The vulnerability is therefore remotely exploitable by an unauthenticated attacker who can reach the API. The NVD description does not provide the specific regex patterns, the exact API path, or the exploit payload structure, so the precise validation-bypass strings are not publicly available from the supplied data.

The impact chain is straightforward:

• pd.read_json() can read JSON-formatted data from a URL or file path, enabling data exfiltration from the Flowise host.
• An attacker-controlled URL in pd.read_json() allows SSRF against internal HTTP services, cloud metadata endpoints, or other systems on the internal network.
• Because the underlying LLM-generated code is executed in a Python runtime, code execution can extend beyond pandas operations. The NVD description explicitly lists remote code execution as a possible outcome through the unauthenticated prediction API.

This flaw is classified as CWE-94, Improper Control of Generation of Code ('Code Injection'). The root cause is not the LLM itself but the insufficient validation and execution boundary around model-generated code.

No public exploit code or Nuclei template is currently associated with CVE-2026-73487. The patch information is limited to an OSV entry claiming a fix in Flowise 3.1.3; the vendor advisory has not been independently confirmed. OSV currently lists the affected package as “/” with an unfixed range, which means the official package metadata does not yet provide a structured affected-version range.

Exploitation Scenarios

The following attack chain is inferred from the NVD description and the vulnerability class. Because no public proof-of-concept is available, these steps describe the expected exploitation mechanics without inventing specific payload syntax.

1. Reconnaissance / Target Identification
   An attacker scans the internet for exposed Flowise instances. Publicly accessible dashboards, agent APIs, or the prediction API are the likely entry points. Shodan queries such as title:"Flowise" or http.html:"Flowise" may be used to identify candidate targets. The attack does not require credentials, so any exposed instance is an immediate candidate.

2. Flaw Trigger / Prompt Injection
   The attacker submits a crafted prompt to the CSV or Airtable Agent node through the unauthenticated prediction API. The prompt contains instructions designed to override the agent's intended behavior and force the model to generate Python code containing dangerous pandas expressions. Because the validator is regex-based, the generated code is checked only for specific blocked literals or patterns; semantically dangerous code that avoids those patterns passes validation.

3. Payload / Execution Method
   At the vulnerability-class level, the generated Python code is executed by the Flowise backend. The NVD description identifies pd.read_json() as an allowed construct. An attacker can cause this function to read from:

   • A local file path, exposing local dataset files or configuration data.
   • An internal HTTP URL, enabling SSRF against internal services.
   • A remote attacker-controlled endpoint, enabling data exfiltration in the HTTP response.

   The NVD description also states that remote code execution is achievable through the prediction API, which implies the attacker can extend the generated Python beyond pandas calls into general Python code execution once the validator is bypassed.

4. Post-Exploitation Impact
   After the injected code executes, the attacker may read sensitive datasets processed by the Flowise agent, issue internal network requests, and potentially gain a foothold on the underlying host. The lack of authentication on the prediction API lowers the barrier to exploitation significantly and allows repeated attempts without detection by access-control systems.

No public PoC exists for CVE-2026-73487 at this time, so the exact payload construction remains unknown. Detection teams should assume that the exploit can be delivered over HTTP POST requests to Flowise prediction endpoints and that the malicious payload will contain prompt-injection language plus Python/pandas expressions such as pd.read_json().

Impact Assessment

CVE-2026-73487 is a remote, unauthenticated code injection vulnerability that can compromise the confidentiality, integrity, and availability of the Flowise host and any data accessible to it.

• Confidentiality: Attackers can read local files and datasets accessible to the Flowise process. If the Flowise service is running with elevated privileges or under a service account with broad filesystem access, sensitive credentials, API keys, and business data are at risk.
• Integrity: Code execution allows the attacker to modify files, plant persistent malware, or alter agent outputs. SSRF can also be used to interact with internal administrative interfaces and change data in other systems.
• Availability: An attacker who achieves remote code execution can crash processes, delete data, or use the host as a pivot point for further attacks.
• Blast Radius: The immediate blast radius is the Flowise host. Because SSRF is explicitly possible, the blast radius extends to internal services reachable from that host. In cloud environments, this often includes cloud metadata services and internal management APIs.
• CVSS Severity: No CVSS score or vector was provided for CVE-2026-73487, so a numeric severity rating cannot be assigned. The absence of authentication, the network reachability, and the potential for RCE nevertheless indicate a critical risk profile.
• EPSS Context: The EPSS score is 0.00389, placing it in the 32.1% percentile of scored CVEs. This indicates a low absolute probability of exploitation in the near term, but the score is not a measure of technical severity and should not be used as the sole basis for prioritization.

Organizations running Flowise versions before 3.1.3 should treat this vulnerability as urgent, especially if the prediction API is exposed beyond trusted networks.

Detection Guidance

The following detection rules are generic and based on the limited public details of CVE-2026-73487. Since no exploit payloads have been published, these rules focus on the two key signals: pd.read_json() appearing in process command lines or HTTP request bodies, and Flowise prediction API activity. Analysts should tune these rules to their environment to avoid false positives from legitimate data-processing workloads.

Sigma Rule

title: Flowise CSV/Airtable Agent Python Code Injection Attempt
id: 2026-73487-sigma-01
status: experimental
description: Detects process creation events where a Python interpreter launches with pandas read_json usage consistent with CVE-2026-73487 exploitation.
license: MIT
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73487
tags:
  - attack.t1190
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_python:
    Image|endswith:
      - "/python"
      - "/python3"
  selection_payload:
    CommandLine|contains:
      - "pd.read_json("
      - "read_json("
  condition: selection_python and selection_payload
falsepositives:
  - Legitimate Python data pipelines that read remote JSON files
level: high

YARA Rule

rule flowise_cve_2026_73487
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects likely payload strings for CVE-2026-73487 Flowise code injection"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73487"
        cve = "CVE-2026-73487"
        date = "2026-04-27"
    strings:
        $a = "pd.read_json(" ascii nocase
        $b = "Flowise" ascii nocase
        $c = "prediction" ascii nocase
        $d = "file://" ascii nocase
        $e = "http://" ascii nocase
    condition:
        2 of them and filesize < 1MB
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-73487 Flowise Python Code Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"pd.read_json"; http_request_body; content:"file://"; http_request_body; classtype:attempted-admin; sid:202673487; rev:1;)

Note: If the Flowise prediction API is hosted on a non-standard port, adjust the rule with ip_proto or port filters. The rule avoids dependency on an unconfirmed URI path.

Elastic Detection

process where process.name == "python" and process.command_line like "*pd.read_json*"

This EQL query can be expanded with additional heuristics such as network connections from the Python process to non-standard destinations:

process where process.name == "python" and process.command_line like "*pd.read_json*" and process.command_line like "*http://*"

Splunk SPL Query

(index=web OR index=proxy) method=POST body="*pd.read_json*"
| table _time src_ip dest_ip uri body status_code

For process-level visibility:

(index=linux_sysmon OR index=ossec) CommandLine="*pd.read_json*" Image="*python*"
| table _time host Image CommandLine ParentImage User

Wazuh OSSEC Rule

<group name="flowise,">
  <rule id="100734" level="12">
    <decoded_as>json</decoded_as>
    <field name="command">pd\.read_json</field>
    <description>Flowise CSV/Airtable Agent Python code injection attempt (CVE-2026-73487)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED): a single OSV source claims a fix in Flowise 3.1.3, but the vendor advisory has not been independently confirmed. Until the patch is verified, treat the vulnerability as potentially exposed.

1. Immediate Mitigations

   • Restrict network access to the Flowise prediction API. If it does not need to be internet-facing, place it behind a VPN or an authenticated reverse proxy.
   • Disable the CSV and Airtable Agent nodes if those features are not required by current workflows.
   • Apply a web application firewall (WAF) rule to block request bodies containing pd.read_json( combined with URL or file read indicators.
   • Monitor application and process logs for Python processes executing with pd.read_json arguments.

2. Patch and Upgrade Steps

   • Upgrade Flowise to version 3.1.3 or later if the patch is accepted after validation.
   • Before upgrading, test the new version in a staging environment to confirm that the CSV and Airtable Agent node code validation blocks the reported bypass.
   • Validate the OSV report against an official Flowise advisory or release note when available. Do not rely solely on an unconfirmed third-party claim.
   • Confirm that no affected version is still reachable from untrusted networks after the upgrade.

3. Long-Term Hardening

   • Replace regex-based Python code validation with a strict allowlist-based or AST-based semantic validator that rejects dangerous function calls rather than relying on pattern matching.
   • Execute LLM-generated Python code in a sandboxed environment with network egress restrictions, filesystem isolation, and resource limits.
   • Require authentication for all Flowise API endpoints, including the prediction API.
   • Implement layered defenses against prompt injection, such as instruction boundaries and output filtering for generated code.
   • Maintain network segmentation so that Flowise and other LLM tooling can reach only required internal systems.
   • Subscribe to OSV and vendor advisories for CVE-2026-73487 updates and future Flowise security patches.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73487
• OSV Vulnerability Record: https://osv.dev/vulnerability/CVE-2026-73487
• CWE-94 – Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• Flowise Project (for context and release monitoring): https://github.com/FlowiseAI/Flowise
• CISA KEV: Not applicable — CVE-2026-73487 is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

No known threat actor campaigns or exploit-in-the-wild evidence are publicly available for CVE-2026-73487 at the time of this report.