Sandbox Escape Vulnerability in Flowise by FlowiseAI

CVE-2026-73483

What is CVE-2026-73483?

The Flowise product, including its components, has a vulnerability related to sandbox escape in versions prior to 3.1.3. This flaw allows authenticated users who have access to the /api/v1/node-custom-function endpoint to exploit the JavaScript sandbox utilized by the Flowise application. By supplying malicious parameters to the puppeteer.launch() function, attackers can execute arbitrary operating system commands as the Flowise process user and disclose sensitive files. The vulnerability is particularly critical due to the potential for total system compromise when running in a default Docker environment, emphasizing the need for an update to version 3.1.3 to mitigate risks.

References