CVE-2026-73484
HighCVSS 8.6Summary
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.
Risk Assessment
Risk of data exfiltration and arbitrary file write on the server, potentially leading to confidentiality and integrity compromise.
Recommendation
Upgrade Flowise to version 3.1.3 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.