CVE-2026-73484

UNKNOWN 0.0

Flowise before 3.1.3 Sandbox Escape via Pandas Methods

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

CWE	CWE-184
Vendor	flowiseai
Product	flowise
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for flowiseai flowise

Be the first to know when new unknown vulnerabilities affecting flowiseai flowise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

FlowiseAI / Flowise

0 < 3.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x58f-9m57-qc4m vulncheck.com: https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-via-pandas-methods

Credits

🔍 sivaadityacoder