{"action":"Upgrade flowise-components to 3.1.3 or later.","affected":[{"fixed":"3.1.3","introduced":"0"}],"component":"flowise-components","cve_ids":["CVE-2026-73487"],"ecosystem":"npm","epss":0.00961,"exploited":false,"fixed_versions":["3.1.3"],"ghsa_id":"GHSA-w7x8-q2gp-5cgg","id":"tcs_01M5KGED19BWHYZK4MN0Q08EMM","modified_at":"2026-10-07T16:30:05.802932685Z","published_at":"2026-10-07T16:17:21Z","references":["https://osv.dev/vulnerability/GHSA-w7x8-q2gp-5cgg","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg","https://nvd.nist.gov/vuln/detail/CVE-2026-73487","https://github.com/FlowiseAI/Flowise","https://www.vulncheck.com/advisories/flowise-before-prompt-injection-rce-via-csv-agent"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-w7x8-q2gp-5cgg#npm/flowise-components","url":"https://osv.dev/vulnerability/GHSA-w7x8-q2gp-5cgg"}],"summary":"Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass"}