FlowiseAI Flowise versions before 3.1.0 contain a command injection vulnerability (CWE-77) in the Airtable_Agents class's run method. The vulnerability arises from insufficient sandboxing when evaluating Python scripts generated by a large language model (LLM). An attacker who can send prompts to a chatflow node using the Airtable Agent can exploit prompt injection to induce the LLM to produce malicious Python code, which is then executed on the server. This leads to remote code execution on the Flowise server. The vulnerability has a CVSS 4.0 score of 9.2 (critical). The issue is resolved in version 3.1.0.

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the Flowise server remotely. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability can lead to full system compromise, data theft, or service disruption.

Upgrade Flowise to version 3.1.0 or later, where this vulnerability is fixed. There is no official patch or temporary fix other than upgrading. Until upgraded, restrict access to the Airtable Agent node to trusted users only, if possible. Monitor for suspicious activity related to prompt injection attempts. Patch status is confirmed fixed in version 3.1.0.