Flowise: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-73483
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 13, 2026
- Source last modified
- October 24, 2026
Description
Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.
Description quoted from the NVD record.
Who is affected
This flaw affects Flowise, a tool for building apps that use AI language models, in versions 3.1.2 and earlier. The problem is in the custom function feature, which lets users run their own code inside a protected area. A user who can log in and use that feature can break out of the protected area, run any commands on the server, and read any file on it. In the official Docker image, commands run with full administrator rights. In versions 3.0.8 through 3.1.2, this works only when a setting that allows built-in code libraries is turned on. Earlier versions are open by default. This flaw is rated High.
What to do
- Find out who installed or runs Flowise for your organization: a staff member, a volunteer, or an IT provider.
- If someone in your organization runs it, ask them to update Flowise to version
3.1.3or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update to version
3.1.3will be done. - If you are not sure whether your organization uses Flowise, ask the person who looks after your computers to check.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.