On October 7, 2026, GitHub published critical advisories for two popular open-source low-code builders for LLM agents, Flowise and Langflow.
Flowise’s CVE-2026-73487 (GHSA-w7x8-q2gp-5cgg, CVSS 4.0 score 9.0) concerns its CSV Agent and Airtable Agent nodes, which run LLM-generated pandas code in Pyodide after screening it with validatePythonCodeForDataFrame(), a blocklist of 38 regular expressions. The researchers showed several structural bypasses reachable through prompt injection via the unauthenticated prediction API. The simplest: pd.read_json with an attacker URL plus df.to_json() passes every check and sends the whole loaded dataset to an external server, and the same trick enables server-side request forgery against internal services. A second Flowise advisory the same day, CVE-2026-73483 (CVSS 4.0 score 9.4), escaped its NodeVM JavaScript sandbox by passing attacker-chosen executablePath and args to puppeteer.launch(), giving OS command execution as root in the official Docker image. Both are fixed in Flowise 3.1.3.
Langflow’s CVE-2026-105697 (GHSA-w794-rj3p-xv45, CVSS 3.1 score 9.9) is about the Model Context Protocol. Before Langflow 1.10.3, the stdio MCP transport launched whatever command and arguments a user put into an MCP server configuration, wrapped in bash -c, with no allowlist. Any user who could reach the MCP server settings or build a flow with the MCP Tools component could run arbitrary OS commands on the host, even when the UI then reported that the server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, an exposed instance handed out a token without credentials, so no account was needed. A first fix in 1.9.0 covered only the REST path; 1.10.3 enforced the policy at the execution sink.
Why it matters: both bugs come from treating text as safe once it has passed a light filter. A blocklist cannot enumerate everything a data library can do with a URL, and an MCP stdio server is simply a program launch. Langflow has already been exploited in the wild for credential theft this year, and Google counted Flowise and Langflow among the orchestration frameworks behind 782 of the more than 1,500 AI-stack CVEs disclosed from January to August 2026.
What it does not show: neither advisory reports exploitation of these specific CVEs, and the Flowise data-exfiltration path requires a deployed CSV or Airtable agent chatflow.