All vulnerabilities
CVE-2026-73483GHSA-9gvv-qjj3-2p6g

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

FlowiseAI flowisenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Aug 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.62%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.1.3Fixed versionGitHub
Published13 Aug 2026Updated 7 Oct 2026CVE List

What fixes it

  • 3.1.3flowise, npmGitHubnpm install flowise@3.1.3
  • 3.1.3flowise-components, npmGitHubnpm install flowise-components@3.1.3
  • 3.1.3FlowiseCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.

Text from CVE List

Affected versions 6

  • flowise, npm<= 3.1.2GitHub
  • flowise-components, npm<= 3.1.2GitHub
  • Flowiseaffected: all versions before 3.1.3CVE List
  • Flowiseunaffected: 3.1.3CVE List
  • flowise, npmfrom first release, fixed in 3.1.3OSV
  • flowise-components, npmfrom first release, fixed in 3.1.3OSV

References 4