VYPR
← All advisories
High severity8.1NVD Advisory· Published Aug 13, 2026· Updated Oct 23, 2026

CVE-2026-73484

CVE-2026-73484

Description

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Flowiseai/Flowise2 versions
    cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*range: <3.1.3
    • (no CPE)range: <3.1.3

Patches

Vulnerability mechanics

References

2

News mentions

2