Flowise Airtable Agent Node Prompt-Injection to Sandbox Escape RCE

Technical Analysis

The Airtable Agent node in Flowise accepts user-supplied prompts that can be crafted to inject Python code intended for execution within a pyodide (WASM-based Python) runtime. The pythonCodeValidator blocklist, meant to filter dangerous constructs, can be bypassed via obfuscation techniques (e.g., string concatenation, encoding, alternate import syntax), allowing attacker-controlled code to reach the interpreter. Critically, the pyodide environment is not properly sandboxed/isolated from the host, so code executed there has full access to the underlying operating system rather than being contained. The entry point is unauthenticated chatflow input, meaning any external user interacting with a deployed chatflow can trigger this, crossing the boundary from prompt-level input directly into host-level code execution with no privilege checks in between.

Affected Systems

Flowise

Detection Signatures

• Monitor Airtable Agent node inputs for obfuscated Python constructs (e.g., chr()/ord() chains, base64-decoded exec/eval, unusual string concatenation forming import/exec/os/subprocess keywords)
• Log and alert on pyodide runtime invoking os, sys, subprocess, or __import__ calls
• Alert on chatflow requests containing blocklist-evasion patterns such as unicode homoglyphs or whitespace injection within code-like tokens
• Unexpected outbound network connections or file system access originating from Flowise worker processes

Remediation Steps

1. 1

   Upgrade Flowise

   Update to Flowise 3.1.3 or later where the vulnerability is patched.

2. 2

   Sandbox the pyodide execution environment

   Ensure any code execution node (Airtable Agent or similar) runs in a properly isolated sandbox (container, gVisor, or WASM runtime with restricted syscalls) with no access to host OS resources, filesystem, or network by default.

3. 3

   Defense-in-depth input validation

   Do not rely solely on blocklist-based validators; use allowlist-based parsing/AST validation of submitted code and reject anything that fails static analysis, rather than pattern-matching known-bad strings.

4. 4

   Require authentication on chatflow endpoints

   Restrict access to chatflows that expose code-execution capable nodes to authenticated and authorized users only.

5. 5

   Least privilege for Flowise service accounts

   Run Flowise workers under a low-privilege service account with restricted filesystem, network, and process permissions to limit blast radius if code execution occurs.