Vulnerability Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input is directly applied to the question parameter within the prompt template and it is reflected to the Python code without any sanitization. This vulnerability is fixed in 3.1.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | < 3.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f228-chmx-v6j6ExploitVendor Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f228-chmx-v6j6ExploitVendor Advisory
FAQ
What is CVE-2026-41138?
CVE-2026-41138 is a vulnerability with a CVSS score of 8.8 (HIGH). Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input veri...
How severe is CVE-2026-41138?
CVE-2026-41138 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41138?
Check the references section above for vendor advisories and patch information. Affected products include: Flowiseai Flowise.