CVE-2026-73483 FlowiseAI CVE debrief

Who should care

Flowise users and administrators, security teams, and anyone responsible for maintaining or securing Flowise installations should review and address this vulnerability. This includes operators managing Flowise deployments, platform administrators, vulnerability management teams, and security personnel responsible for monitoring and mitigating potential threats. Additionally, organizations using Flowise in their environments should assess their exposure and take necessary actions to protect against potential exploitation. This may involve coordinating with vendors, applying patches, or implementing compensating controls to reduce the risk of exploitation until a patch can be applied. Furthermore, users of Flowise should verify their versions and ensure they are up-to-date or patched, restrict access to the /api/v1/node-custom-function endpoint, and monitor for suspicious activity to implement compensating controls effectively. Flowise users should also consider reviewing relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Lastly, Flowise users may need to inventory Flowise installations and verify versions are up-to-date or patched to ensure the security of their environments. This involves confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up to ensure timely remediation and minimize potential impact on operations and security posture. Therefore, a coordinated effort between technical teams and security stakeholders is crucial to effectively manage and mitigate the risks associated with this vulnerability in Flowise installations. The CVE-2026-73483 record indicates that Flowise versions <= 3.1.2 contain a sandbox escape vulnerability in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user can exploit this by supplying attacker-controlled parameters to puppeteer.launch(). This allows execution of arbitrary OS commands and file disclosure. The issue is fixed in version 3.1.3. To enhance their security posture, Flowise users should consider these factors when

Technical summary

The Flowise package, including flowise and flowise-components, versions <= 3.1.2, contains a sandbox escape vulnerability in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(). This internally invokes child_process.spawn() outside the sandbox boundary, allowing execution of arbitrary OS commands as the Flowise process user and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2, exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. The issue is fixed in version 3.1.3.

Defensive priority

Authenticated users with access to the /api/v1/node-custom-function endpoint can escape the sandbox and execute arbitrary OS commands as the Flowise process user.

Recommended defensive actions

• Inventory Flowise installations and verify versions are up-to-date or patched
• Restrict access to the /api/v1/node-custom-function endpoint
• Monitor for suspicious activity and implement compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-73483 record indicates that Flowise versions <= 3.1.2 contain a sandbox escape vulnerability in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user can exploit this by supplying attacker-controlled parameters to puppeteer.launch(). This allows execution of arbitrary OS commands and file disclosure. The issue is fixed in version 3.1.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.