CVE-2026-73483
highpriority · track · 35EPSS 0.006 · 49 %ileDEEUUSEPSS · scored 2026-10-22
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.7–9.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2589Flowise: Mehrere SchwachstellenDeutsch2026-07-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Sitzungen zu kapern sowie Daten offenzulegen oder zu manipulieren.
- GHSA-9gvv-qjj3-2p6gFlowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium2026-10-07ghsa · osvUS
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's `file://` URL handling. In versions 3.0.8–3.1.2 exploitation requires `ALLOW_BUILTIN_DEP=true`; earlier versions are exploitable by default. Fixed in 3.1.3.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/FlowiseAI/Flowise/releasesPatchcnnvd
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9gvv-qjj3-2p6gcnnvd
- https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-via-puppeteercnnvd
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9gvv-qjj3-2p6genisa_euvd
- https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-via-puppeteerenisa_euvd
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9gvv-qjj3-2p6gExploitMitigationVendor Advisorynvd
- https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-via-puppeteerThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan