EXPOSURES › CVE-2026-73602
CVE-2026-73602
CRITICALFlowise before 3.1.3 allows authenticated users to execute arbitrary code via a sandbox escape in the vm2 JavaScript sandbox.
An authenticated attacker can bypass path traversal checks by crafting a fake String object to load and execute malicious JavaScript files outside the sandbox. This RCE failure matters to DIB orgs because it breaks the isolation of the application, enabling full system compromise if the application is exposed. Organizations must patch to 3.1.3 immediately and restrict network access to the application.
Shame score — A critical RCE in a sandboxed component was exploitable via a simple crafted object, indicating a fundamental failure in secure coding and sandbox isolation.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.