CVE-2026-73484 is a sandbox escape in Flowise. The Python code validator blocks a list of strings but misses native Pandas methods such as to_csv and to_json, so an authenticated user can exfiltrate uploaded CSV data or write files to the server. The record scores it 8.1, High. Upgrade to Flowise 3.1.3.
What's affected
The record says Flowise before 3.1.3 is affected. The GitHub advisory lists the flowise npm package at 3.1.2 and earlier, patched in 3.1.3. The two agree on the fix.
The flaw sits in pythonCodeValidator.ts. The advisory explains that the validator uses a denylist of 44 patterns that block dangerous strings such as eval, exec, os and subprocess. Because the CSV agent uses Pandas by default, native Pandas DataFrame methods, including to_csv, to_json, pipe and query, are not blocked. The advisory says an authenticated user who interacts with the CSV agent can steer the language model to produce those allowed methods, and so exfiltrate data or write files on the server.
The weakness class is CWE-184, incomplete list of disallowed inputs. A denylist always has gaps.
How to check if you're exposed
Find the Flowise version on every deployment.
npm ls flowise
docker ps --format '{{.Names}} {{.Image}}'
If the package or image tag is at 3.1.2 or lower, you are in the affected range. Then check whether you use the CSV agent, or any flow that runs model written Python over uploaded data. If you do, that is the path the advisory describes. Also review who has accounts, since the attacker must be authenticated. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.
What to do now
- Upgrade flowise to 3.1.3 or later, and redeploy containers.
- Review flows that use the CSV agent, and turn off the ones that are not needed.
- Restrict account creation and review existing accounts.
- Run Flowise with a file system that is read only except for the paths it must write.
- Check the server for files written by flows in unexpected locations.
- Treat uploaded CSV data as exposed if you suspect misuse, and notify data owners as your policy requires.
Why it matters
A denylist tries to name everything bad, and attackers need only one thing the list forgot. Here the forgotten thing was ordinary library functionality, which the tool is designed to use. Safer designs allow a short list of operations and run code in an environment that has no file or network access of its own.
The record scores this 8.1 High under CVSS 3.1. The GitHub advisory labels it High, and VulnCheck lists high at 8.6 under CVSS 4.0, so the sources agree on direction. The language model in the loop adds a twist. The attacker does not write the code, but steers the model to write it, which makes input filtering harder. No source says the flaw has been exploited in the wild, and the CVE is not on the CISA KEV list.
Quick check
Why did the validator miss these methods?
It blocks a list of dangerous strings, and native Pandas methods like to_csv and to_json are not on that list.
What fixes it?
Flowise 3.1.3, per the record and the advisory.
Sources
Last reviewed: 18 October 2026.
