P5Verified

CVE-2026-73483: flowise <= 3.1.2; +1 more affected products

CVE-2026-73483 affects flowise. EPSS 0.0074 (percentile 0.53114), scored 2026-10-06. Affected range: <= 3.1.2. Fixed version: 3.1.3. Affected range: <= 3.1.2. Fixed version: 3.1.3.

Affected technology

flowise · <= 3.1.2
Vendor not specified by the source

flowise-components · <= 3.1.2
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary.

Published 2026-10-08 08:56:16.542060+00:00

Product: flowise
CCR priority: 0.2 /100 (P5)
EPSS: 0.0074 · percentile 0.53114 · 2026-10-06
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-08 08:50:52.119177+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-73483.html