Tools AI Risk Radar ai-incident-0147
Incident record
Flowise fixes prompt-driven leaks from CSV and Airtable agents
- Severity
- Critical
- Status
- Patched
- Type
- Prompt Injection
- Target
- flowise, flowise-components
- Actor
- researcher
- CVE
- CVE-2026-73487
What happened
Malicious instructions sent to a CSV or Airtable agent could make generated Python transmit its loaded data to an outside server or request internal services. The code validator accepted unsafe operations in the researcher’s demonstration.
flowise: affected <= 3.1.2; fixed in 3.1.3. flowise-components: affected <= 3.1.2; fixed in 3.1.3. The date shown is the maintainer’s original disclosure date.
Sources
- Primary disclosuregithub.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026