CVE-2026-73602
CriticalCVSS 9.0Summary
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
Risk Assessment
An authenticated attacker can execute arbitrary code outside the sandbox, potentially leading to system compromise or data theft.
Recommendation
Update Flowise to version 3.1.3 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.