Flowise before version 3.1.3 contains a regex-based Python code validation bypass in the CSV and Airtable Agent nodes. This flaw permits unauthenticated attackers to inject arbitrary Python code through prompt injection. By exploiting the bypass, attackers can execute unblocked pandas functions such as pd.read_json(), enabling data exfiltration, server-side request forgery against internal services, or full code execution through the publicly accessible prediction API.

The vulnerability impacts FlowiseAI's Flowise application on all releases earlier than 3.1.3. No specific patch version list is provided beyond the statement that versions before 3.1.3 are affected, so any deployment of Flowise pre‑3.1.3 is at risk.

The CVSS score of 9 indicates a high‑severity flaw with high impact and potential for complete compromise. The EPSS score is not available, but the vulnerability is exploitable via unauthenticated access to the prediction API, as the description notes that the attack can be carried out without authentication. The vulnerability is not yet listed in CISA’s KEV catalog, but the combination of high severity, unrestricted access, and code execution payloads makes it a top threat for affected deployments.