Skip to main content

Flowise EUVDEUVD-2026-57800

| CVE-2026-73484 HIGH
Incomplete List of Disallowed Inputs (CWE-184)
2026-08-13 VulnCheck GHSA-354w-hcpx-6wvw
RCE Flowise
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Network-exploitable via authenticated Python code submission requiring only low-privilege credentials; no availability impact and no scope change beyond the Flowise server process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 13:01 EUVD
Analysis Generated
Aug 13, 2026 - 12:53 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
HIGH 8.6

DescriptionCVE.org

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

Articles & Coverage 1

medium.com CVE-2026-73484: Python Sandbox Escape in Flowise AI Platform via Pandas Library Aug 24, 2026

AnalysisAI

Sandbox escape in Flowise's Python code execution layer (pythonCodeValidator.ts) allows authenticated low-privilege users to invoke native Pandas DataFrame methods - to_csv, to_json, pipe, and query - that the validator's denylist fails to restrict. All Flowise deployments prior to version 3.1.3 are vulnerable, with a CVSS 4.0 score of 8.6 reflecting high confidentiality and high integrity impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to Flowise with low-privilege credentials
Delivery
Open workflow Python code node editor
Exploit
Craft Pandas method call (to_csv, pipe, or query)
Execution
Submit code bypassing pythonCodeValidator.ts denylist
Persist
Server executes Pandas with filesystem permissions
Impact
Exfiltrate CSV data or write arbitrary files
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated account on the target Flowise instance - the CVSS 4.0 PR:L metric confirms that low-privilege credentials are sufficient and no administrative or elevated role is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) presents a direct exploitation path: network-accessible, low complexity, requiring only low-privilege authentication with no additional preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Flowise user with any valid low-privilege account opens a workflow editor and adds a Python code node containing a call such as pd.read_csv('/app/uploads/sensitive.csv').to_csv('/var/www/html/exfil.csv') or uses pipe() to pass a DataFrame through an os.system() wrapper. Because pythonCodeValidator.ts does not include these Pandas methods in its denylist, the validator passes the code without triggering any block, and the server executes it under its own process credentials. …
Remediation Upgrade Flowise to version 3.1.3 or later, which patches pythonCodeValidator.ts to include to_csv, to_json, pipe, and query in the method denylist; full details are in the GitHub Security Advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x58f-9m57-qc4m. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Flowise deployments and verify current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Flowise

View all
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2025-8943 CRITICAL POC
9.8 Aug 14

Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
CVE-2025-26319 CRITICAL POC
9.8 Mar 04

FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
CVE-2026-56274 HIGH POC
8.7 Jun 23

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
CVE-2025-58434 CRITICAL POC
9.8 Sep 12

Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
CVE-2026-30821 CRITICAL POC
9.8 Mar 07

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
CVE-2026-30824 CRITICAL POC
9.8 Mar 07

Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
CVE-2026-70470 CRITICAL POC
9.5 Aug 04

Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
CVE-2025-71334 CRITICAL POC
9.3 Jun 25

Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers

CVE-2026-46442 CRITICAL POC
9.4 Jun 08

Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key

CVE-2026-30820 HIGH POC
8.8 Mar 07

Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
CVE-2026-30823 HIGH POC
8.8 Mar 07

Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2026-70470 CRITICAL POC
9.5
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-2017 HIGH POC
8.8
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8
CVE-2018-6383 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

EUVD-2026-57800 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy