CVE-2026-73602 FlowiseAI CVE debrief

Who should care

Flowise users, administrators of Flowise systems, and security teams responsible for patching and vulnerability management should be aware of this critical vulnerability and take immediate action to protect their systems.

Technical summary

The CVE-2026-73602 vulnerability in Flowise before 3.1.3 is a critical sandbox escape issue in the vm2 JavaScript sandbox. This allows authenticated users to execute arbitrary code by exploiting a bypass in moment locale validation. Attackers can craft a fake String object with a match function to bypass path traversal checks, loading and executing malicious JavaScript files stored in the document store outside the sandbox.

Defensive priority

Authenticated users of Flowise before version 3.1.3 should prioritize patching due to a critical vulnerability allowing arbitrary code execution.

Recommended defensive actions

• Patch Flowise to version 3.1.3 or later
• Restrict access to Flowise to trusted users only
• Monitor Flowise systems for suspicious activity
• Inventory Flowise installations to ensure version 3.1.3 or later is deployed
• Implement compensating controls to limit potential damage from authenticated users

Evidence notes

The CVE-2026-73602 vulnerability in Flowise before 3.1.3 allows authenticated users to execute arbitrary code via a sandbox escape in the vm2 JavaScript sandbox. The issue arises from a bypass in moment locale validation. Limited information is available on the exact scope of affected systems and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.