CVE-2026-73483

Flowise versions 3.1.2 and earlier contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox (CWE-78) that allows code to break out of the intended isolation and execute on the host. An authenticated user with access to the /api/v1/node-custom-function endpoint triggers the flaw by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally calls child_process.spawn() outside the sandbox boundary. Successful exploitation yields arbitrary OS command execution as the Flowise process user (root in the official Docker image) as well as arbitrary host file disclosure through Chromium's file:// URL handling. All deployments at or below 3.1.2 are affected; versions 3.0.8 through 3.1.2 are only exploitable when ALLOW_BUILTIN_DEP=true, while earlier versions are exploitable by default. No in-the-wild exploitation is currently known (not in CISA KEV, EPSS about 0.6%), but a public advisory with a proof-of-concept reference exists and the flaw is fixed in 3.1.3.

What to do: Upgrade Flowise (both flowise and flowise-components packages) to 3.1.3 or later. If upgrading is not immediately possible on 3.0.8-3.1.2, ensure ALLOW_BUILTIN_DEP is not enabled, and in all cases restrict /api/v1/node-custom-function to fully trusted users and avoid exposing Flowise to unauthenticated or low-trust accounts. Review process and API logs for unexpected child process spawns or Chromium launches with unusual executablePath/args, since these would indicate exploitation.