CVE-2026-73602

9.9 Critique

Publiée le 13/08/2026 à 14:17 · Modifiée le 04/09/2026 à 21:35 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.

Traduire en français

Produits concernés

FlowiseAI Flowise

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.0 Critique	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.9 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-95

Références

https://github.com/FlowiseAI/Flowise/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 Broken Link
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rqh4-rxw3-93rp ExploitVendor Advisory
https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-to-rce Third Party Advisory

CVE-2026-73602

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs