Sandbox Escape Vulnerability in Flowise by FlowiseAI

CVE-2026-73484

What is CVE-2026-73484?

Flowise versions earlier than 3.1.3 present a vulnerability that allows authenticated attackers to escape from the intended sandbox environment. This issue occurs in the 'pythonCodeValidator.ts' file, where the application does not effectively restrict the use of certain native Pandas DataFrame methods, such as to_csv, to_json, pipe, and query. As a result, attackers could exfiltrate sensitive CSV data uploaded to the service or write arbitrary files to the server's filesystem, potentially leading to further exploitation.

References