The vulnerability arises from improper sandboxing of dynamically generated Python code within the Airtable_Agents component of Flowise. An attacker can craft a prompt that tricks an LLM into producing a malicious script, which the application then executes on the host machine. If successful, the attacker gains the privileges of the Flowise process, allowing full system compromise.

FlowiseAI’s Flowise platform, versions prior to 3.1.0, that expose the Airtable Agent node. The flaw is present in the run method of the Airtable_Agents class.

The CVSS score of 9.2 reflects a high severity remote code execution risk. The EPSS score is reported as less than 1%, indicating a low but non‑zero probability of exploitation in the wild at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires only the ability to send a prompt to an Airtable Agent enabled chatflow and no additional authentication, the threat vector remains remote and unauthenticated, making the vulnerability attractive to adversaries that can interact with the exposed interface.