Flowise, a widely adopted low-code agentic orchestration platform for building AI workflows, has completely removed the AirtableAgent and CSVAgent components following the discovery of a remote code execution vulnerability with a CVSS score of 9.4. The ZDI-26-546 advisory, published August 11, 2026, documents an unauthenticated flaw in the run method of the Airtable_Agents class that allows arbitrary Python code injection. The vendor's decision to eliminate the functionality entirely rather than patch it signals a structural severity that transcends a single bug.
- ZDI-26-546 / CVE-2026-69264: Unauthenticated RCE in Flowise with CVSS 4.0 9.4 CRITICAL, per the official CVE record.
- The flaw resides in the
runmethod of Airtable_Agents: missing validation of a user-supplied string before Python code execution. - Flowise remediated by removing AirtableAgent and CSVAgent in PR #6499, deleting approximately 277 and 243 lines respectively, not by patching the code.
- Coordinated ZDI disclosure timeline: vendor reported April 22, 2026; public release August 11, 2026 — a nearly four-month exposure window.
The Mechanism: From User Input to Code Injection in a Node.js Context
The vulnerability triggers through the typical execution chain of AI orchestration platforms. The Airtable_Agent receives user input, processes it by generating dynamic Python code, and executes it via Pyodide, the Python runtime in WebAssembly. According to the ZDI advisory, the run method of the Airtable_Agents class fails to validate the user-supplied string before using it for Python code execution.
This missing validation opens a code injection path. The injected Python code operates within the JavaScript-Node.js bridge context, allowing escape from the runtime sandbox and execution of operating-system-level commands in the Flowise process. No authentication is required to exploit the vulnerability; it is direct exposure on the network surface.
"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not required to exploit this vulnerability." — Zero Day Initiative, advisory ZDI-26-546
CVSS 9.4 and the Official Classification: Numbers from the CVE Record
The CVE-2026-69264 record, published by GitHub as CNA, assigns the vulnerability a CVSS 4.0 score of 9.4 with a CRITICAL rating. The full vector — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — confirms remote access without user interaction, with maximum impact on confidentiality, integrity, and availability of both the vulnerable system and subsequent scopes.
An element of complexity emerges from the CVE record description, which technically refers to the CSVAgent component with data URI interpolation in a Python template executed by Pyodide, not the Airtable_Agent cited in the ZDI title. The dossier does not clarify whether this is the same vulnerability with multiple scopes or separate advisories converging on the same fixed version. Both components were removed in the same PR.
The Fix as Amputation: Why the Vendor Chose Removal
PR #6499, merged June 10, 2026 with commit 12e699cfb9de1a00b1073bfc990f64b525c19677, does not modify the vulnerable code; it deletes it. The commit message — "fix(flowise-606): remove AirtableAgent and CSVAgent due to security v..." — documents a clear architectural choice. Approximately 277 lines of AirtableAgent.ts and 243 of CSVAgent.ts were removed.
This pattern is telling. When a vendor prefers removing an entire feature over patching, the problem exceeds a single implementation error. Dynamic execution of Python code on unstructured user input represents an intrinsic risk class: the attack surface is the model itself, not just the parser. Version 3.1.3, indicated by the CVE record as the fixed version, closes this window by removing the components.
The Time Window: 111 Days Between Report and Disclosure
The ZDI timeline shows a vendor report on April 22, 2026 and a coordinated release on August 11, 2026. This interval of approximately 111 days represents the exposure window for unpatched installations. The dossier does not document whether in-the-wild exploits or public proof-of-concepts emerged during this period, nor does it identify the researcher who discovered the vulnerability.
The most relevant concrete impact data for readers is the combination of three factors: unauthenticated remote execution, a near-maximum CVSS score, and growing adoption of Flowise in enterprise production environments. Low-code AI orchestration platforms are deployed with privileges to access databases, APIs, and internal services: compromise of the Flowise node often equates to compromise of the entire workflow.
Why It Matters
The dossier does not specify the exact nature of data exposed in compromised installations. It does not document whether variants of the vulnerability exist in other platform agents, nor does it provide full exploit mechanism details for the specific Airtable_Agent — the CVE record technically describes the CSVAgent.
The source does not indicate alternative remediation measures to component removal, nor operational recommendations for users who cannot upgrade immediately. No infrastructure overlap currently links the actor to known attack campaigns. The researcher's identity and the potential presence of public exploits remain unconfirmed.
The ZDI-26-546 case illustrates a structural tension in current AI architecture: the convenience of visual orchestration translates to dynamic code execution on external input, with poorly defined trust boundaries between the user prompt and system privileges. Flowise's removal of the vulnerable components is a radical solution that leaves users with broken workflows, but acknowledges the inadequacy of sandboxing against the threat. For organizations that have deployed Airtable or CSV agents in production, the priority is verifying the installed version and assessing impact on existing automated processes.
FAQ
Which Flowise versions are affected?
The CVE record indicates Flowise versions prior to 3.1.3. The dossier does not specify whether the Airtable_Agent vulnerability affects all prior versions or a subset.
Why did the vendor remove the components instead of patching them?
PR #6499 deletes approximately 277 and 243 lines of code for AirtableAgent and CSVAgent respectively. The choice of removal suggests the risk class — dynamic Python code execution on user input — was deemed unmanageable with a localized fix.
The CVE record describes CSVAgent, not Airtable_Agent: is it the same bug?
The dossier does not resolve this potential mismatch. Both components were removed in the same PR with the same security rationale, but the CVE record technically describes CSVAgent with data URI interpolation in a Python template.
Sources
Information verified against cited sources and current as of publication.