Flowise: Ten RCE and Data Exposure Vulnerabilities Disclosed Together
Key findings • Ten vulnerabilities disclosed for Flowise on August 13, 2026, impacting versions prior to 3.1.3 and 3.1.4. • Multiple critical vulnerabilities allow for remote code execution a…
Key findings
- Ten vulnerabilities disclosed for Flowise on August 13, 2026, impacting versions prior to 3.1.3 and 3.1.4.
- Multiple critical vulnerabilities allow for remote code execution and sandbox escapes through insecure JavaScript and Python code handling.
- Sensitive data, including API keys and credentials, are exposed via plaintext retrieval and improper access controls.
- Insecure direct object reference allows authenticated users to access other customers' data.
- Patches are available in Flowise versions 3.1.3 and 3.1.4.
On August 13, 2026, a significant batch of ten vulnerabilities was disclosed for Flowise, an open-source low-code tool for building LLM applications. The vulnerabilities, affecting versions prior to 3.1.3 and 3.1.4, range in severity from Medium to Critical, with several allowing for remote code execution and sandbox escapes. These disclosures highlight critical security weaknesses within Flowise's core components, including its JavaScript sandbox, API endpoints, and agent nodes.
A major theme among these vulnerabilities is the potential for code injection and sandbox escapes. CVE-2026-73602, CVE-2026-73601, CVE-2026-73487, and CVE-2026-73485 all detail ways attackers can execute arbitrary code. Specifically, CVE-2026-73602 and CVE-2026-73483 exploit vulnerabilities in the vm2 JavaScript sandbox, allowing authenticated users to bypass security measures and execute malicious code. CVE-2026-73601 points to a flaw in the Custom MCP node, enabling command execution via environment variable manipulation when CUSTOM_MCP_PROTOCOL is set to stdio. Furthermore, CVE-2026-73487 and CVE-2026-73485 highlight issues in the CSV and Airtable Agent nodes, respectively, where regex-based validators can be bypassed through obfuscation, leading to code injection.
Another critical area of concern is the insecure handling of sensitive data and credentials. CVE-2026-73604 describes an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint, which exposes decrypted secrets in plaintext. This could allow authenticated users with specific permissions to access sensitive information like database connection URLs with embedded passwords. Similarly, CVE-2026-73603 reveals that Flowise fails to validate chatflow visibility in its unauthenticated text-to-speech endpoint, enabling unauthenticated attackers to abuse private chatflow TTS credentials and generate audio using stored API keys. CVE-2026-73488, an insecure direct object reference vulnerability, allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter.
The batch also includes vulnerabilities related to data exfiltration and file system manipulation. CVE-2026-73486, a regex-based Python code validator bypass in CSV and Airtable Agent nodes, can be exploited for prompt injection, potentially leading to data exfiltration. CVE-2026-73484, a sandbox escape in pythonCodeValidator.ts, fails to block native Pandas DataFrame methods, allowing authenticated attackers to exfiltrate uploaded CSV data or write arbitrary files to the server.
All identified vulnerabilities have been addressed in Flowise version 3.1.3, with the exception of CVE-2026-73603, which is fixed in version 3.1.4. Users are strongly advised to update to the latest versions to mitigate these risks. The widespread nature of these vulnerabilities, affecting multiple components and attack vectors, underscores the importance of prompt patching for Flowise users to protect their applications and sensitive data from compromise.
The timely disclosure of these ten vulnerabilities by the Flowiseai team provides users with the necessary information to secure their deployments. The critical nature of several flaws, particularly those enabling remote code execution and data breaches, necessitates immediate attention from all users of the Flowise platform.
Key findings from this disclosure include:
- Multiple critical remote code execution vulnerabilities stemming from sandbox escapes and insecure code validation.
- Sensitive data, including API keys and credentials, exposed due to incomplete redaction and improper access controls.
- Insecure direct object reference allowing access to other customers' data.
- Vulnerabilities affecting both JavaScript and Python code execution environments within Flowise.
- Patches are available in Flowise versions 3.1.3 and 3.1.4.
The vulnerabilities disclosed in this batch include CVE-2026-73604, CVE-2026-73603, CVE-2026-73602, CVE-2026-73601, CVE-2026-73488, CVE-2026-73487, CVE-2026-73486, CVE-2026-73485, CVE-2026-73484, and CVE-2026-73483.