CVE-2026-73484

Flowise before 3.1.3 contains a sandbox escape in its Python code validator (pythonCodeValidator.ts), which uses an incomplete blocklist (CWE-184) that fails to deny native Pandas DataFrame methods such as to_csv, to_json, pipe, and query. An authenticated attacker who can submit or run code in a Flowise Python execution node can invoke these unblocked methods to break out of the sandbox. Successful exploitation allows the attacker to exfiltrate uploaded CSV data processed by the workflow or write arbitrary files to the server filesystem, with no availability impact. Any Flowise deployment running a version earlier than 3.1.3 is affected, including self-hosted installs and hosted instances where tenants can execute Python code. Exploitation has not been reported in the wild (not in CISA KEV, EPSS at 0.4% over 30 days), but a public vendor advisory with PoC reference (GHSA-x58f-9m57-qc4m) is available, and the flaw is rated high severity at CVSS 4.0 8.6.

What to do: Upgrade Flowise to 3.1.3 or later. Until patched, restrict which authenticated users can run pythonCode nodes, limit exposure of Flowise instances to the internet, and review the server filesystem for unexpected file writes and logs for signs of CSV data exfiltration. Hosted Flowise users should confirm their instance is running the patched release.