CVE-2026-73483: Flowise NodeVM Sandbox Escape Leading to Authenticated RCE and Arbitrary File Read
Summary
CVE-2026-73483: Flowise (packages flowise and flowise-components) in versions. Affects flowise versions < 3.1.3. Fixed in 3.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flowise is an open-source platform designed for building and deploying AI workflows. It allows users to create custom functions and integrate various components seamlessly. The platform is built using Node.js and leverages Puppeteer for browser automation. However, certain versions of Flowise and its components are vulnerable to a critical security flaw that can lead to unauthorized command execution and file access.
Vulnerability Detail
The vulnerability arises from a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox used by Flowise. An authenticated user can exploit this by sending malicious parameters to the /api/v1/node-custom-function endpoint, specifically the executablePath and args parameters in puppeteer.launch(). This allows the execution of arbitrary OS commands as the Flowise process user, which is root in the official Docker image, and enables unauthorized access to host files through Chromium's file URL handling. The issue is present in versions 3.1.2 and earlier, with exploitation requiring the ALLOW_BUILTIN_DEP=true setting in versions 3.0.8 to 3.1.2. Earlier versions are vulnerable by default.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install flowise@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.3
This is the first release that contains the fix.
npm install flowise@3.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the /api/v1/node-custom-function endpoint to trusted users only, or disable the ALLOW_BUILTIN_DEP setting if it is enabled. However, the best course of action is to update to the patched version.
Conclusion
The CVE-2026-73483 vulnerability in Flowise poses a significant risk due to its potential for remote code execution and unauthorized file access. It is crucial for users to update to version 3.1.3 or later to protect their systems. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for flowise →
FAQ
CVE-2026-73483 is a critical vulnerability in Flowise that allows authenticated users to escape the NodeVM sandbox and execute arbitrary commands on the host system.
Versions of Flowise and Flowise-components up to and including 3.1.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 9.4, indicating a critical level of severity.
If immediate updating is not possible, consider restricting access to the vulnerable endpoint and disabling any settings that may exacerbate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
