CVE-2026-73602

Critical

Description

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.

SeverityCritical

CVSS9.9

Exploit probability58. percentile0.8%

ProductFlowise

PublishedAug 13, 2026

First seenAug 13, 2026

Weakness typeCWE-95CWE-95

How to fix

Update

flowiseai flowise3.1.3 or later

Patches

github.com/FlowiseAI/Flowise/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5

Vendor advisories

github.com/FlowiseAI/Flowise/security/advisories/GHSA-rqh4-rxw3-93rp

Affected products

Product	Affected versions	Fixed in
flowiseai flowise	v < 3.1.3	3.1.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.