Flowise 3.1.2's CSV/Airtable Agent validators can be bypassed, leading to data exfiltration and SSRF.

In Flowise 3.1.2 and earlier versions, the CSV Agent and Airtable Agent nodes use regex blacklists to validate LLM-generated Python code, and there are multiple structural bypasses. Attackers can perform prompt injection through the unauthenticated prediction API to exfiltrate all loaded data to an external server or launch SSRF against internal services. The vulnerability is rated Critical (CVSS 3.1 9.3) and affects all instances deploying a CSV Agent or Airtable Agent chatflow. The most direct bypass is pd.read_json with a URL parameter, which passes all 38 regex checks and issues an HTTP request carrying the dataset; additionally, importlib can bypass the import word boundary, chr() can concatenate function names, and np.ctypeslib can load native libraries.