CVE-2026-73602: Flowise before 3.1.3 Sandbox Escape to RCE
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73602?
The severity of CVE-2026-73602 is rated at 77, indicating a significant risk.
How do I fix CVE-2026-73602?
To fix CVE-2026-73602, upgrade Flowise to version 3.1.3 or later.
What kind of vulnerability is CVE-2026-73602?
CVE-2026-73602 is a sandbox escape vulnerability that allows remote code execution due to a validation bypass.
Who is affected by CVE-2026-73602?
Authenticated users of Flowise versions prior to 3.1.3 are at risk of CVE-2026-73602.
How does CVE-2026-73602 exploit work?
CVE-2026-73602 exploits a moment locale validation bypass to allow arbitrary code execution through a crafted fake String object.