vm2 JavaScript sandbox escape to RCE in Flowise (CVE-2026-73602)

Flowise contains a sandbox escape vulnerability in its vm2-based JavaScript execution environment, affecting the Custom Function and Custom Tool nodes. An authenticated attacker can craft a fake String object whose `match` method bypasses the moment locale path-traversal check, allowing arbitrary JavaScript files stored in the document store to be loaded and executed outside the sandbox, resulting in remote code execution on the host process. Affected versions: - <= 3.1.2 - FlowiseAI/nodevm 3.9.25 We recommend updating to: 3.1.3. CVSS 9.0 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rqh4-rxw3-93rp Details: https://vuln.today/cve/CVE-2026-73602