CVE-2026-73486 is a code injection vulnerability in FlowiseAI's Flowise product prior to version 3.1.3. The issue exists in the CSV Agent node's customReadCSV parameter, where the input validation relies on a static regex blocklist that can be circumvented using obfuscation. This enables authenticated attackers to execute arbitrary Python code within the unsandboxed pyodide environment, resulting in full system access. The vulnerability has a CVSS 4.0 score of 9.0, indicating critical severity. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

Successful exploitation allows authenticated attackers to execute arbitrary Python code with full system access on the host running Flowise. This can lead to complete compromise of the affected system, including unauthorized data access, modification, or destruction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users only and monitor for suspicious activity related to the CSV Agent node's customReadCSV parameter. Avoid using untrusted inputs in this parameter.