CVE-2026-73602

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Authenticated users can achieve arbitrary code execution by escaping the vm2 JavaScript sandbox. This is possible by exploiting a validation bypass in the moment locale, where an attacker can create a fake String object with a match function. This technique bypasses path traversal checks, allowing the loading and execution of malicious JavaScript files stored in the document store outside the sandbox environment.

Recommendations Update Flowise to version 3.1.3 or later.