Flowise CVE-2026-73484

Exploitation requires a valid authenticated account on the target Flowise instance - the CVSS 4.0 PR:L metric confirms that low-privilege credentials are sufficient and no administrative or elevated role is needed. The attacker must be able to create or edit a workflow containing a Python code execution node, which is a standard Flowise feature available by default without special configuration. No non-default server settings are required. Exploitation is bounded by the need for a valid user account: unauthenticated external attackers cannot exploit this directly. Deployments that restrict workflow authoring to a small set of fully trusted administrators reduce practical risk, as do deployments that have entirely disabled Python code nodes in workflow configurations.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) presents a direct exploitation path: network-accessible, low complexity, requiring only low-privilege authentication with no additional preconditions. The exploitation status supplement (E:X) is undefined, confirming no vendor-acknowledged active exploitation at time of scoring, and there is no CISA KEV listing, which measurably reduces immediate triage urgency relative to confirmed in-the-wild activity. No EPSS score was provided in available intelligence. However, the attack primitives - the specific unblocked Pandas method names - are fully disclosed in the published advisory, sharply compressing the knowledge gap for any authenticated attacker. Even a mid-sized municipal IT team in swidnica operating a self-hosted Flowise instance should treat this as urgent, because PR:L means any holder of a valid user account is a potential attacker, not just administrators - widening the effective threat actor pool considerably. The combination of full disclosure of bypass methods and low-privilege exploitation makes this a high-priority patch rather than a theoretical concern.

An authenticated Flowise user with any valid low-privilege account opens a workflow editor and adds a Python code node containing a call such as pd.read_csv('/app/uploads/sensitive.csv').to_csv('/var/www/html/exfil.csv') or uses pipe() to pass a DataFrame through an os.system() wrapper. Because pythonCodeValidator.ts does not include these Pandas methods in its denylist, the validator passes the code without triggering any block, and the server executes it under its own process credentials. No public proof-of-concept has been identified at time of analysis, but the specific unblocked method names are fully enumerated in the advisory, materially reducing the skill barrier for exploitation.