# Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

Flowise Airtable Agent evaluates LLM-generated Python in Pyodide; a regex denylist bypass via aliased imports lets unauthenticated prompt injection run OS commands on the server.

- Payout: Research
- Severity: critical
- Program: Flowise
- Found by: zdi-disclosures
- Disclosed: 2026-04-18
- CVE: CVE-2026-41265
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-v38x-c887-992f
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-v38x-c887-992f
- Tags: area:ai domain:ai domain:web impact:rce kind:research platform:ghsa sev:critical tech:llm tech:nodejs tech:python technique:incomplete-fix vuln:command-injection vuln:prompt-injection vuln:rce

**Target:** Airtable Agent node in Flowise chatflow (Pyodide Python evaluation)
**Root cause:** LLM-generated Python is executed in Pyodide with only a regex denylist (FORBIDDEN_PATTERNS) as protection; the import regex `/\bimport\s+(?!pandas|numpy\b)/g` can be bypassed by importing pandas alongside os with aliases, so arbitrary OS commands run.
**Steps:**
1. Install flowise@3.0.13 with `npm install -g flowise@3.0.13` and start with `npx flowise start` (port 3000).
2. Create a chatflow containing the Airtable Agent node (with Airtable token/base/table) and an LLM node.
3. Send a prompt to `/api/v1/prediction/<chat_id>` containing a prompt injection that makes the LLM output `import pandas as np, os as pandas` followed by `pandas.system("xcalc")`.
4. The regex validator passes because `import pandas` matches; Pyodide executes the code and runs the OS command.
5. Alternatively (authenticated): point the chatflow's LLM node at an attacker server returning the malicious script, or use an attacker-controlled Airtable table with injection in column names.
**How found:** Advisory notes this bypasses the sanitization added for CVE-2026-41138; the pattern intends to search for lines of code which import a module other than pandas or numpy, but can be bypassed by importing along with pandas or numpy, so aliasing os as pandas slips through.
**Exploitation:** Unauthenticated attacker sends a crafted question to a chatflow using the Airtable Agent node; the LLM is induced to emit Python that imports os aliased as pandas and calls pandas.system(cmd). The script passes validatePythonCodeForDataFrame and is run via pyodide.runPythonAsync, executing arbitrary commands as the Flowise server user. Authenticated variants swap the LLM endpoint for an attacker server or poison Airtable column names.
**Escalation:** Three exploitation paths: unauthenticated prompt injection, authenticated malicious LLM server, and authenticated malicious Airtable table with injected column names.
**Insight:** Regex denylists on generated code are bypassable via aliasing and multi-import lines; when auditing LLM code-execution sandboxes, check whether the import regex anchors on the module name and whether aliasing (`import os as pandas`) or combined imports defeat it.

## Proof of concept (copied exactly from the original report)

**Bypass payload importing os aliased as pandas**

```
import pandas as np, os as pandas
pandas.system("xcalc")
```

**PoC script invocation syntax**

```
python3 poc.py --method [server OR chatflow OR prompt_injection] [--user <USER> --passwd <password> --host <HOST> --r_host <R_HOST> --r_port <R_PORT> --l_port <L_PORT> --port <PORT> --cmd <CMD> --chatflow_id <CHAT_ID> --airtable_token <AIRTABLE_TOKEN> --base_id <BASE_ID> --table_id <TABLE_ID>]
```