Flowise is a drag‑and‑drop interface for building large‑language‑model flows. An unvalidated user input in AirtableAgent.ts leads to direct insertion into a Pandas‑based Python prompt, enabling arbitrary code execution. The flaw allows execution of arbitrary Python code with the privileges of the Flowise process, potentially affecting confidentiality, integrity, and availability.

Flowise AI Flowise versions older than 3.1.0 are affected. Version 3.1.0 and later contain the fix that validates prompt inputs before execution.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation today, and it is not yet listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending a crafted prompt through the Flowise web interface; by leveraging the lack of sanitization the attacker can inject malicious Python code that the backend executes with the privileges of the Flowise process.