CVE-2026-73483 in Flowise
Summary
by MITRE • 08/13/2026
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The Flowise JavaScript sandbox escape vulnerability represents a critical security flaw in the vm2/@flowiseai/nodevm execution environment that affects versions 3.1.2 and earlier. This vulnerability stems from improper handling of user-supplied parameters within the custom function execution pathway, specifically through the /api/v1/node-custom-function endpoint. The flaw allows authenticated attackers to bypass sandbox restrictions by manipulating executablePath and args parameters passed to puppeteer.launch(), which subsequently invokes child_process.spawn() outside the intended security boundaries.
The technical implementation of this vulnerability leverages the inherent weaknesses in JavaScript sandboxing mechanisms where attacker-controlled inputs can influence process execution flows. When users supply malicious parameters to puppeteer.launch(), the underlying Chromium browser instance executes with elevated privileges, enabling arbitrary OS command execution as the Flowise process user. In containerized deployments using the official Docker image, this translates to root-level access due to the privileged execution context. The vulnerability also incorporates file disclosure capabilities through Chromium's file:// URL handling mechanism, allowing attackers to read arbitrary files from the host system.
This exploit operates under the attack pattern of sandbox escape techniques and falls under the CWE-94 category of Code Injection, specifically targeting the Node.js sandbox environment. The vulnerability demonstrates a classic privilege escalation pathway where authenticated access to specific API endpoints enables full system compromise. The exploitation requires an authenticated user with access to the custom function endpoint, making it particularly dangerous in environments where multiple users have administrative privileges. The requirement for ALLOW_BUILTIN_DEP=true in versions 3.0.8-3.1.2 indicates that this vulnerability was initially mitigated through configuration controls but could still be exploited by default in earlier releases.
The operational impact of this vulnerability extends beyond simple code execution to include complete system compromise and data exfiltration capabilities. Attackers can execute arbitrary commands with the privileges of the Flowise process, potentially leading to further lateral movement within networks or access to sensitive data stored on the host system. The file disclosure mechanism through Chromium's file handling creates additional attack vectors for information gathering and reconnaissance activities. Organizations using Flowise in production environments face significant risk from this vulnerability, particularly those that do not maintain strict access controls or regularly update their software installations.
Mitigation strategies should focus on immediate version upgrades to 3.1.3 or later where the vulnerability has been patched. Security teams must implement strict access controls around the /api/v1/node-custom-function endpoint and consider disabling built-in dependencies when possible. Additional protective measures include network segmentation, monitoring for suspicious API usage patterns, and implementing comprehensive logging of custom function executions. The fix addresses the core issue by properly sanitizing user inputs and preventing direct execution of child processes outside the sandbox boundaries, thereby maintaining the intended security isolation of the JavaScript execution environment. Organizations should also conduct thorough security reviews of their Flowise installations to ensure no other similar vulnerabilities exist within the broader codebase or related components.