CVE-2026-41138 is a code injection vulnerability classified as CWE-94 in FlowiseAI's Flowise product before version 3.1.0. The issue arises from the AirtableAgent.ts file where user input is applied directly to the 'question' parameter within a prompt template used in Python code, without any sanitization. This allows an attacker with at least low privileges to execute arbitrary code remotely. The vulnerability has a CVSS 3.0 score of 8.3, indicating high severity with network attack vector, low attack complexity, no user interaction, and impacts confidentiality, integrity, and availability. The vendor fixed this issue in version 3.1.0, but no explicit patch advisory is provided in the data.

Successful exploitation allows an attacker with low privileges to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality and integrity, and partial availability impact. This can result in unauthorized control over the Flowise environment and any underlying resources it accesses.

Upgrade Flowise to version 3.1.0 or later where this vulnerability is fixed. Since no official patch advisory is provided, users should consult the vendor's official channels for confirmation and additional guidance. Until upgraded, avoid exposing vulnerable versions to untrusted users or networks.