PT-2026-34730 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41138

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description Remote code execution is possible in AirtableAgent.ts due to a lack of input verification when using Pandas. User input is directly applied to the question parameter within the prompt template and reflected into the Python code without sanitization.

Recommendations Update to version 3.1.0.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-41138

GHSA-F228-CHMX-V6J6

Affected Products

Flowise

References · 5

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f228-chmx-v6j6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41138 · Security Note
• https://osv.dev/vulnerability/GHSA-f228-chmx-v6j6 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/CVEnew/status/2047428082202767818 · Twitter Post