Remote Code Execution Vulnerability in Flowise by FlowiseAI
CVE-2026-41138

8.3HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41138?

Flowise, a drag & drop interface for constructing customized large language model workflows, is susceptible to a remote code execution vulnerability prior to version 3.1.0. The flaw exists in the AirtableAgent.ts file due to inadequate input validation, allowing unverified user input to be passed directly into the prompt template. This input is reflected within the Python code without any sanitization, leading to potential code execution risks. This issue has been addressed in version 3.1.0, highlighting the importance of secure coding practices in the development of applications handling user-generated content.

Affected Version(s)

Flowise < 3.1.0

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM

CVSS V3.0

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.