CVE-2026-73484 — Flowise pythonCodeValidator.ts Sandbox Escape

Executive Summary

CVE-2026-73484 is a sandbox escape vulnerability in Flowise versions prior to 3.1.3, residing in the pythonCodeValidator.ts validation component. An authenticated attacker can bypass an incomplete denylist (CWE-184) by invoking native Pandas DataFrame methods — to_csv, to_json, pipe, and query — to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem. Any organization running self-hosted Flowise with its Python code execution feature exposed to authenticated users is at risk; no CVSS score, public exploit, or independent patch confirmation is available at the time of writing.

Technical Analysis

Flowise provides authenticated users with the ability to build and run data/LLM flows that include Python code execution. The component pythonCodeValidator.ts is responsible for validating Python source before it runs inside a restricted execution sandbox. The vulnerability stems from the validation approach itself: it relies on a denylist of prohibited constructs, functions, attributes, and method calls. This design maps directly to CWE-184 — Incomplete List of Disallowed Inputs: the strictness of the control depends entirely on the completeness of the blocklist, and an incomplete blocklist becomes a partial or fully ineffective security boundary.

According to the NVD description, the validator fails to block native Pandas DataFrame methods, specifically:

• to_csv — serializes a DataFrame to CSV and can write to a file path.
• to_json — serializes a DataFrame to JSON, enabling data exfiltration.
• pipe — applies an arbitrary callable/function to a DataFrame, allowing chained execution.
• query — evaluates an arbitrary expression string against a DataFrame.

The attack mechanism is consistent with a classic sandbox-escape flaw: the sandbox assumes that disallowing a handful of known-dangerous functions is sufficient, but attackers reach the same native capability through alternate, unlisted methods. Because uploaded CSV data is processed into Pandas DataFrames within the Python sandbox, a DataFrame object is already present and attacker-influenced. Calling to_csv on such an object with an attacker-controlled path yields direct file write to the server filesystem; calling to_json yields a structured serialization that can be smuggled out of the sandbox via the legitimate output channel; pipe and query provide expression-evaluation and callback-execution primitives that broaden the attacker's reach inside the sandbox.

Data quality caveats: insufficient public technical detail is available beyond the advisory text. No CVSS vector has been assigned (N/A), no CNA title was provided, the affected-version list is empty, and the OSV package entry shows 0 → unfixed even though OSV is also cited as the patch source — the patch status is therefore treated as CLAIMED with confidence 2/4. At the code level, only pythonCodeValidator.ts and the four Pandas method names mentioned above are confirmed; no other file paths, function names, or URL endpoints are disclosed.

Exploitation Scenarios

No public PoC was available at the time of writing; the attack chain below is inferred strictly from the vulnerability class and the method names named in the NVD description.

Step 1 — Reconnaissance / target identification. An attacker fingerprints publicly exposed Flowise instances (e.g., via web banners and search-engine dorks), identifies a version before 3.1.3, and obtains access to an authenticated account — either through legitimate credentials, weak authentication, or another pre-authentication flaw. Because the flaw requires authentication, the attacker's initial foothold is an application user session.

Step 2 — Triggering the flaw class. The attacker navigates to the Flowise feature that accepts Python code and submits a snippet that operates on a Pandas DataFrame derived from uploaded CSV data. The validator (pythonCodeValidator.ts) inspects the submitted code and, because its denylist is incomplete (CWE-184), allows the payload to pass validation. Code that calls the four blocked-but-unlisted methods is not rejected and proceeds to the sandbox interpreter.

Step 3 — Payload / execution method. At the vulnerability-class level, the payload exploits the gap between what the validator blocks and what the underlying Python interpreter permits. The attacker crafts code that calls:

• to_csv(...) with a target path to write arbitrary CSV-formatted content (or, by abusing object state, arbitrary file content) to the server filesystem;
• to_json(...) to serialize sensitive DataFrame contents into JSON and return it through the application's normal output channel to the attacker;
• .pipe(...) and .query(...) to execute additional Python callables or expression strings within the sandbox, chaining further native operations.

The sandbox escape is realized because these methods are native DataFrame methods that execute with the full privileges of the sandbox process rather than being restricted by the validator.

Step 4 — Post-exploitation impact. With the sandbox escaped, the attacker achieves two confirmed primitives: (a) exfiltration of uploaded CSV datasets (confidentiality breach of any sensitive data stored in uploads), and (b) arbitrary file write on the server. File write can be leveraged for persistence (e.g., dropping scripts into startup or cron locations), further code execution, or destructive overwrites of application files. The practical end-state is comparable to remote code execution on the Flowise host, constrained only by the operating-system account under which the application runs.

Impact Assessment

• Affected systems: Self-hosted Flowise deployments running versions prior to 3.1.3, specifically where the Python code execution/validation feature is enabled.
• Business impact: High on confidentiality — uploaded CSV data frequently contains proprietary or sensitive datasets used for LLM training/grounding. High on integrity — arbitrary file write permits tampering with application files, poisoning data artifacts, or planting backdoors. Moderate on availability — an attacker can overwrite critical files, causing service disruption.
• Blast radius: The sandbox escape moves the attacker from application-level, constrained code execution to native filesystem access on the host. If Flowise runs with elevated privileges or alongside other services, the blast radius expands accordingly.
• Risk metrics: No CVSS score is assigned (N/A). EPSS is 0.00289 (21.4th percentile among exploited CVEs), indicating low current exploitation likelihood. CISA KEV: NO. No threat-actor campaigns or in-the-wild exploitation evidence have been reported.
• Preconditions: Requires an authenticated session (e.g., a standard Flowise user) and an enabled Python code execution surface — a realistic precondition in collaborative deployments where multiple users share a Flowise instance.

Detection Guidance

Detection of this vulnerability relies on observing either the exploit payload (code submissions containing the disclosed Pandas methods) or post-exploitation artifacts (anomalous file writes, unexpected outbound data). Since no public exploit exists, the rules below are best-effort heuristics; SOC teams should tune them to their environment's logging.

Sigma Rule

title: Flowise Sandbox Escape Payload in Web Request
id: 4f9c7d2e-73a1-4b81-b2ef-9a3a6c1f9c01
status: experimental
description: >
  Detects HTTP requests whose query string or request body contains native Pandas
  DataFrame sink methods (to_csv, to_json, pipe, query) commonly used in payloads
  targeting the Flowise pythonCodeValidator.ts sandbox escape (CVE-2026-73484).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73484
logsource:
  category: webserver
  product: apache
detection:
  selection_sinks:
    cs-uri-query|contains:
      - 'to_csv('
      - 'to_json('
      - '.pipe('
      - '.query('
  selection_context:
    cs-uri-query|contains:
      - 'flowise'
      - 'chatflow'
      - 'python'
  condition: selection_sinks and selection_context
falsepositives:
  - Legitimate Python code-node usage by authorized Flowise developers
  - Other web applications accepting Pandas-style code in URLs
level: high

YARA Rule

rule flowise_sandbox_escape_payload_cve_2026_73484
{
    meta:
        author      = "ValtersIT Threat Intelligence"
        description = "Detects Python source strings abusing native Pandas DataFrame methods for Flowise sandbox escape (CVE-2026-73484)"
        reference   = "CVE-2026-73484"
        date        = "2026-01-01"

    strings:
        $s1 = /\.to_csv\s*\(/ nocase
        $s2 = /\.to_json\s*\(/ nocase
        $s3 = /\.pipe\s*\(/ nocase
        $s4 = /\.query\s*\(/ nocase
        $s5 = /pd\.read_csv/ nocase
        $s6 = /dataframe/i
        $s7 = /from\s+pandas/ nocase

    condition:
        filesize < 2MB and
        (2 of ($s1, $s2, $s3, $s4)) and
        (1 of ($s5, $s6, $s7))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73484 Flowise sandbox escape payload in HTTP request body"; flow:established,to_server; content:".to_csv("; http_request_body; nocase; fast_pattern; content:".to_json("; http_request_body; nocase; distance:0; content:".pipe("; http_request_body; nocase; distance:0; content:".query("; http_request_body; nocase; distance:0; reference:cve,2026-73484; classtype:attempted-admin; sid:273484; rev:1;)

Elastic Detection

file where event.category == "file" and event.action in ("creation", "write") and
  process.name in ("python", "python3", "node", "nodejs") and
  (file.extension in ("php", "jsp", "sh", "cron") or file.name in ("authorized_keys", "crontab")) and
  not file.path : "*/tmp/pip-*" and
  not file.path : "*/.cache/*"

The rule above is a post-exploitation heuristic for the arbitrary-file-write primitive: a Python or Node process (the Flowise server/sandbox) creating executable or persistence-oriented files. SOCs should correlate this with prior web requests containing the payload tokens from the Sigma rule.

Splunk SPL Query

index=* (sourcetype=access_combined OR sourcetype=iis OR sourcetype=apache:access)
  (uri_query="*to_csv(*" OR uri_query="*to_json(*" OR uri_query="*.pipe(*" OR uri_query="*.query(*")
  AND (uri_query="*flowise*" OR uri_query="*chatflow*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri uri_query status
| where count > 1
| sort - count

Complementary audit-log query for anomalous file writes on the Flowise host:

index=linux_audit sourcetype=linux_audit (comm=python OR comm=python3 OR comm=node)
  AND (type=SYSCALL AND syscall=openat AND key=file_write)
  AND (file.path="*/var/www/*" OR file.path="*/etc/cron*" OR file.path="*/home/*/.ssh/*")
| table _time host src_ip uid comm file.path result

Wazuh OSSEC Rule

<group name="flowise,sandbox_escape,">
  <rule id="100734" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.to_csv\(|\.to_json\(|\.pipe\(|\.query\(</field>
    <description>CVE-2026-73484: Potential Flowise pythonCodeValidator.ts sandbox escape payload detected in web request</description>
    <group>attacker,payload,flowise,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). OSV reports that the issue is fixed in Flowise 3.1.3, but this is a single-source claim and not independently confirmed. Note the inconsistency in the data: OSV is listed as the patch source, yet the OSV package entry shows 0 → unfixed. Treat the patch status as unverified and validate against the vendor's official release notes before rollout.

1) Immediate mitigations:

• Restrict network exposure of the Flowise web UI (VPN, firewall allowlists, reverse-proxy authentication) to reduce the authenticated attack surface.
• Enforce strong authentication and multi-factor authentication for all Flowise accounts.
• If the Python code execution feature is not business-critical, disable it entirely or restrict it to a small set of trusted administrators.
• Run the Flowise service under a least-privilege operating-system account with read-only access to application directories and no write access to web-served or system directories.
• Actively monitor access logs and file-integrity events for the patterns described in the Detection Guidance section.

2) Patch / upgrade steps:

• Plan an upgrade to Flowise >= 3.1.3 in a staging environment first.
• Independently confirm the fix by reviewing the vendor's release notes and, if possible, the pythonCodeValidator.ts diff to verify that the four disclosed methods (to_csv, to_json, pipe, query) are now blocked.
• After patching, re-test the Python code execution feature to confirm that legitimate workflows still function and that the four sink methods are rejected.

3) Long-term hardening:

• Replace the denylist-based validation (the root cause per CWE-184) with an allowlist approach or, preferably, a true OS-level sandbox (containerization, seccomp, restricted interpreter) so that validation gaps do not equate to host compromise.
• Apply the principle of least privilege to the Flowise service account and underlying filesystem.
• Integrate Flowise into the organization's vulnerability-management and asset-inventory processes so that future advisories reach the responsible team quickly.
• Re-evaluate this CVE periodically; CISA KEV status is currently NO, and EPSS is low (0.00289), but both metrics can change as exploitation evidence emerges.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-73484
2. OSV Vulnerability Record — https://osv.dev/vulnerability/CVE-2026-73484
3. CWE-184 — Incomplete List of Disallowed Inputs — https://cwe.mitre.org/data/definitions/184.html
4. Flowise GitHub Repository — https://github.com/FlowiseAI/Flowise
5. Flowise Releases — https://github.com/FlowiseAI/Flowise/releases

Threat-actor campaigns / in-the-wild evidence: None known at the time of writing. The CVE is not listed in CISA KEV (NO), no public PoC, Nuclei template, or exploit code has been identified, and the low EPSS score (0.00289) indicates no significant exploitation activity observed in the wild.