CVE-2026-73483: High Sandbox Escape and RCE in Flowise

CVE-2026-73483 is a sandbox escape in Flowise. An authenticated user of the custom function endpoint can use puppeteer to run operating system commands outside the JavaScript sandbox, as root in the official Docker image. The record scores it 8.8, High. Upgrade flowise and flowise-components to 3.1.3.

What's affected

The record says Flowise 3.1.2 and earlier is affected and that 3.1.3 fixes it. The GitHub advisory lists the flowise and flowise-components npm packages at 3.1.2 and earlier, patched in 3.1.3.

Exposure depends on the version. The record says that in versions 3.0.8 through 3.1.2, exploitation requires the ALLOW_BUILTIN_DEP setting to be true. Earlier versions are exploitable by default. The attacker must be an authenticated user with access to the /api/v1/node-custom-function endpoint.

The advisory gives the root cause. The package list available inside the sandbox included puppeteer. Puppeteer's launch function takes a caller controlled executable path and arguments, and starts a child process from its own code, which runs outside the sandbox boundary. The advisory adds that Chromium file URL handling allows arbitrary host file disclosure. The weakness class is CWE-78, improper neutralization of special elements used in an OS command.

How to check if you're exposed

Find the Flowise version on every deployment.

npm ls flowise flowise-components
docker ps --format '{{.Names}} {{.Image}}'

The second command lists container image tags, so you can see whether a running container uses a tag at or below 3.1.2. Then check the setting that decides exposure on versions 3.0.8 and later.

env | grep ALLOW_BUILTIN_DEP

If it is set to true on a version in that range, you match the record. Versions before 3.0.8 do not need the setting. Finally, list who has accounts. Any authenticated user with access to the custom function endpoint can use the flaw. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.

What to do now

1. Upgrade flowise and flowise-components to 3.1.3 or later, and redeploy containers.
2. Until you can, make sure ALLOW_BUILTIN_DEP is not true on versions 3.0.8 through 3.1.2.
3. Do not run Flowise as root. Use a non-root container user and a read only file system where you can.
4. Restrict who can create accounts and who can reach the custom function endpoint.
5. Keep Flowise off the public internet, or put it behind an authenticating proxy.
6. Rotate API keys and credentials stored in Flowise if you suspect misuse.

Why it matters

Sandboxes for user code only hold if every module that the code can reach is safe to expose. A browser automation library is not. It exists to start programs and open files, so putting it inside a sandbox hands out the very power the sandbox is meant to hold back. The advisory frames the root cause as an architectural choice, not a small coding slip.

The sources differ on severity. The record scores it 8.8 High under CVSS 3.1. The GitHub advisory labels it Critical, and VulnCheck lists critical at 9.4 under CVSS 4.0. Use the higher rating if your instance is reachable by many users, and note that the official image runs as root, which raises the impact. No source says the flaw has been exploited in the wild, and the CVE is not on the CISA KEV list.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub security advisory for Flowise
• VulnCheck advisory

Last reviewed: 18 October 2026.