CVE-2026-73483

Executive Summary

CVE-2026-73483 is a sandbox escape vulnerability in Flowise packages flowise and flowise-components affecting versions up to and including 3.1.2. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the JavaScript sandbox (vm2/@flowiseai/nodevm) by abusing attacker-controlled executablePath and args parameters passed to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. Successful exploitation results in arbitrary OS command execution as the Flowise process user, which is root in the official Docker image, as well as arbitrary host file disclosure via Chromium's file:// URL handling. No CVSS score or vector has been published for this vulnerability, and no public exploit code or CISA KEV listing was identified at the time of analysis.

Technical Analysis

Flowise is a visual AI workflow builder that exposes a custom function node allowing users to execute JavaScript as part of an automation pipeline. The custom function runtime is executed inside a JavaScript sandbox, vm2 / @flowiseai/nodevm, intended to prevent user-defined scripts from reaching host operating system primitives. The vulnerability class is a sandbox escape that permits an otherwise sandboxed script to invoke a host-level process creation API.

The NVD description indicates that the escape is reachable through the /api/v1/node-custom-function endpoint. A malicious authenticated user supplies JavaScript to this endpoint that calls puppeteer.launch() with attacker-controlled executablePath and args options. The executablePath parameter normally specifies the Chromium binary location, and args provides command-line arguments to the browser process. However, because puppeteer.launch() internally uses child_process.spawn() to start the browser process, the OS process is created by the host Node.js runtime rather than inside the sandbox execution context. The sandbox boundary is therefore bypassed: the JavaScript code is constrained by the VM, but the spawned child process is not.

This primitive directly maps to CWE-78, Improper Neutralization of Special Elements used in an OS Command. In practical terms, an attacker can point executablePath at an arbitrary executable on the host and use args to form a command line of their choosing. Because the process spawn occurs outside the sandbox, the command executes with the privileges of the Flowise process user.

The NVD description also notes host file disclosure as a distinct impact. Chromium launched through the same mechanism can be instructed to navigate to file:// URLs, allowing an attacker to read files from the host filesystem that are accessible to the Flowise process user. This may be accomplished through the browser's file handling rather than through command execution, or as a complementary effect of the same spawned Chromium process. The exact implementation details of the file-disclosure payload are not provided in the public description.

Version-specific conditions affect exploitability. In Flowise versions 3.0.8 through 3.1.2, exploitation requires the environment variable ALLOW_BUILTIN_DEP=true to be set. Versions prior to 3.0.8 are exploitable by default, meaning no special environment configuration is required. The fixed version is 3.1.3. The patch confidence is rated 2/4 because the fix is claimed by a single source, OSV, and has not been independently confirmed by a second source at the time of writing.

Exploitation Scenarios

No public proof-of-concept or in-the-wild exploit has been confirmed for CVE-2026-73483. The attack chain below is inferred from the NVD description and the vulnerability class.

1. Target identification and reconnaissance. An attacker first identifies Flowise installations that are exposed on the internet or reachable within an enterprise network. Shodan searches for Flowise web applications can be used to locate candidate targets. The attacker must also obtain valid credentials for an account with access to the custom function feature. The relevant attack surface is the /api/v1/node-custom-function endpoint.

2. Triggering the sandbox escape. The attacker authenticates to Flowise and submits a custom function payload to the /api/v1/node-custom-function endpoint. This endpoint is designed to accept user-defined JavaScript. For versions 3.0.8 through 3.1.2, the Flowise server must be running with ALLOW_BUILTIN_DEP=true; otherwise the feature required for exploitation is disabled. For versions before 3.0.8, no such environment variable is required, making those versions exploitable by default.

3. Payload and execution. The malicious JavaScript invokes puppeteer.launch() with an executablePath that points to an attacker-chosen binary on the host system. The args parameter supplies additional command-line arguments. Because puppeteer.launch() internally calls child_process.spawn() outside the sandbox boundary, the resulting process is created directly by the host Node.js runtime. This allows the attacker to execute arbitrary OS commands with the privileges of the Flowise process user. In the official Docker image, that user is root, resulting in full compromise of the container. Host file disclosure can likewise be achieved by launching Chromium and using its file:// URL handling to read files from the host filesystem.

4. Post-exploitation impact. After achieving OS-level command execution, the attacker can enumerate the host filesystem, exfiltrate secrets, modify or delete files, pivot to other systems reachable from the Flowise host, and, in containerized deployments, potentially abuse container privileges to access host resources. If the service runs as root, the attacker gains root-level control of the container or, on non-containerized hosts, root-level control of the entire operating system.

Impact Assessment

CVE-2026-73483 is a critical sandbox escape vulnerability because it converts authenticated access to a low-privilege web application feature into native OS command execution. The impact is especially severe in Docker deployments because the official Flowise Docker image runs the process as root. An attacker who compromises the web application can therefore gain root access inside the container, read arbitrary host files made available through mounted volumes, and execute commands with the container's full privilege set.

The published CVSS score and vector are N/A, so no CVSS subscore analysis can be performed. The EPSS score is 0.00374, placing the vulnerability at the 30.6th percentile of exploited CVEs; this indicates a relatively low near-term exploitation probability, but it should not be interpreted as low severity. The vulnerability is not listed in CISA KEV, and no public exploit code or Nuclei template was identified. The absence of a CVSS score and public exploit code is likely due to the recent disclosure timeline and incomplete patch confirmation.

Affected systems include all Flowise deployments running version 3.1.2 or earlier, particularly those where the custom function endpoint is exposed to authenticated users. The blast radius includes the Flowise application itself, the host filesystem contents readable by the service account, and, in containerized environments, the container runtime environment. If the Flowise host has access to cloud credentials, database connections, or internal network segments, an attacker can use this vulnerability as an entry point for lateral movement.

Detection Guidance

Detection of CVE-2026-73483 should focus on three observable artifacts: suspicious HTTP requests to the Flowise custom-function endpoint, anomalous child processes spawned by the Flowise Node.js process, and filesystem or file-read behavior consistent with Chromium file:// URLs. The most reliable detection signal is the combination of the /api/v1/node-custom-function URI with payload strings such as puppeteer.launch and executablePath.

Sigma Rule

title: Flowise Custom Function Sandbox Escape Attempt - CVE-2026-73483
id: 4f6b7d2e-91a3-4c10-8f5d-0b7f9d12a47a
status: experimental
description: Detects HTTP requests to the Flowise /api/v1/node-custom-function endpoint containing markers associated with the CVE-2026-73483 puppeteer.launch sandbox escape.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73483
author: Valtersit Threat Intelligence
date: 2026-05-23
logsource:
    category: webserver
    product: generic
    service: access
detection:
    selection:
        cs-uri-path:
            - /api/v1/node-custom-function
            - /api/v1/node-custom-function/*
    keywords:
        - "puppeteer.launch"
        - "executablePath"
        - "child_process.spawn"
        - "file://"
    condition: selection and keywords
falsepositives:
    - Legitimate Flowise custom function development may reference puppeteer.launch when building browser automation nodes.
    - Overriding executablePath is uncommon and generally indicates an attempt to alter the launched binary.
level: high

YARA Rule

rule flowise_sandbox_escape_cve_2026_73483
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects JavaScript payloads attempting to exploit CVE-2026-73483 Flowise sandbox escape via puppeteer.launch executablePath abuse"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73483"
        date = "2026-05-23"
        severity = "critical"

    strings:
        $a = "puppeteer.launch" ascii nocase
        $b = "executablePath" ascii nocase
        $c = "args" ascii nocase
        $d = "node-custom-function" ascii nocase
        $e = "child_process.spawn" ascii nocase

    condition:
        filesize < 1MB and
        2 of ($a, $b, $e) and
        1 of ($c, $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73483 Flowise Sandbox Escape - node-custom-function puppeteer.launch attempt"; flow:established,to_server; content:"/api/v1/node-custom-function"; http.uri; nocase; content:"puppeteer.launch"; http.request_body; nocase; content:"executablePath"; http.request_body; nocase; within:500; content:"args"; http.request_body; nocase; within:500; classtype:attempted-admin; sid:2026083483; rev:1; reference:cve,2026-73483;)

Elastic Detection

any where
  http.request.method == "POST" and
  url.path like "*node-custom-function*" and
  http.request.body.content like "*puppeteer.launch*" and
  http.request.body.content like "*executablePath*"

Splunk SPL Query

index=web* OR index=proxy*
(uri_path="/api/v1/node-custom_function" OR uri="/api/v1/node-custom-function*")
AND (body="*puppeteer.launch*" OR form_data="*puppeteer.launch*" OR payload="*puppeteer.launch*")
AND (body="*executablePath*" OR form_data="*executablePath*" OR payload="*executablePath*")
| stats count min(_time) max(_time) by src_ip dest_ip uri uri_path http_user_agent status
| where count >= 1

Wazuh OSSEC Rule

<group name="flowise,">
  <rule id="100734" level="15">
    <decoded as="json"></decoded>
    <field name="url">/api/v1/node-custom-function</field>
    <match>puppeteer\.launch</match>
    <match>executablePath</match>
    <description>Flowise CVE-2026-73483 sandbox escape attempt detected via node-custom-function endpoint</description>
    <group>cve-2026-73483, attack, execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this vulnerability is 2/4 — the fix in Flowise 3.1.3 is claimed by a single source (OSV) but has not been independently confirmed. Organizations should treat the patch as likely effective while validating it in their own environments.

1. Immediate mitigations. Upgrade Flowise and flowise-components to version 3.1.3 or later. If an immediate upgrade is not possible, restrict or block access to the /api/v1/node-custom-function endpoint at the network layer, reverse proxy, or WAF until the patch can be applied. For versions 3.0.8 through 3.1.2, verify that the ALLOW_BUILTIN_DEP environment variable is not set to true. For versions prior to 3.0.8, disable or isolate the custom function feature if possible, because it is exploitable by default.

2. Patch and upgrade steps. Update the affected packages flowise and flowise-components to 3.1.3. After upgrading, confirm the application version, verify that the custom function endpoint still functions as expected, and rerun regression tests for any workflows that legitimately rely on Puppeteer or browser automation. If the patched version introduces configuration changes to ALLOW_BUILTIN_DEP, review the updated documentation and set the environment variable to false unless a business-critical feature requires otherwise.

3. Long-term hardening. Run the Flowise Docker container under a non-root user and restrict the container's filesystem and network privileges. Avoid mounting host directories into the container unless necessary, and ensure secrets are injected through a secrets manager rather than stored in files readable by the application process. Restrict access to Flowise to a trusted user population and enforce least privilege on accounts that can create custom function nodes. Monitor API logs for unusual POST requests to the custom-function endpoint, and deploy the detection rules above as part of a layered defense. Finally, re-evaluate the risk posture when new exploit code or additional patch confirmations become publicly available.

References

• National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-73483
• OSV vulnerability entry: https://osv.dev/vulnerability/CVE-2026-73483
• Flowise project repository: https://github.com/FlowiseAI/Flowise
• CISA Known Exploited Vulnerabilities catalog: not listed for CVE-2026-73483 at the time of analysis

No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-73483 has been identified at the time of writing. The vulnerability should nevertheless be treated as high risk due to its sandbox escape nature, root-level impact in Docker deployments, and the ease of chaining with the authenticated web interface.