GHSA-f228-chmx-v6j6

## Description ### Summary “AirtableAgent” is an agent function provided by FlowiseAI that retrieves search results by accessing private datasets from airtable.com. “AirtableAgent” uses Python, along with `Pyodide` and `Pandas`, to get and return results. The user’s input is directly applied to the question parameter within the prompt template and it is reflected to the Python code without any sanitization. **The point is that an attacker can bypass the intended behavior of the LLM and trigger Remote Code Execution through a simple prompt injection.** ### About Airtable The `airtable.ts` function retrieves and processes user datasets stored on Airtable.com through its API.   The usage of Airtable is as shown in the image above. After creating a Chatflow like above, you can ask data-related questions using prompts and receive answers.  ### Details ```jsx // packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts let base64String = Buffer.from(JSON.stringify(airtableData)).toString('base64') const loggerHandler = new ConsoleCallbackHandler(options.logger) const callbacks = await additionalCallbacks(nodeData, options) const pyodide = await LoadPyodide() // First load the csv file and get the dataframe dictionary of column types // For example using titanic.csv: {'PassengerId': 'int64', 'Survived': 'int64', 'Pclass': 'int64', 'Name': 'object', 'Sex': 'object', 'Age': 'float64', 'SibSp': 'int64', 'Parch': 'int64', 'Ticket': 'object', 'Fare': 'float64', 'Cabin': 'object', 'Embarked': 'object'} let dataframeColDict = '' try { const code = `import pandas as pd import base64 import json base64_string = "${base64String}" decoded_data = base64.b64decode(base64_string) json_data = json.loads(decoded_data) df = pd.Dat