CVE-2026-73602

Executive Summary

CVE-2026-73602 is a sandbox escape vulnerability in the vm2 JavaScript sandbox component embedded in Flowise prior to version 3.1.3. An authenticated user with access to Flowise flow design can craft a fake String object with a malicious match function that defeats moment locale validation and subsequent path traversal checks, allowing the loader to read and execute attacker-controlled JavaScript files stored in the document store outside the sandbox boundary. Exploitation results in arbitrary code execution on the host running the Flowise service.

Technical Analysis

Flowise is a low-code orchestration platform used to build and deploy LLM-based applications. Its design allows users with authenticated access to define application logic, including custom JavaScript code executed server-side. To isolate this untrusted code from the host environment, Flowise leverages vm2, a third-party JavaScript sandboxing library that attempts to restrict access to host object constructors, prototypes, and the Node.js standard library.

The vulnerability resides in the interaction between the vm2 sandbox and the moment date-handling library's locale validation logic. The NVD description identifies the flaw class as a sandbox escape achieved through a moment locale validation bypass. At a mechanism level, locale validation in moment expects a string-like object and evaluates its properties. The attacker supplies a deliberately constructed fake String object that overrides the match function. Because this match implementation is attacker-controlled, it executes in a privileged context during validation and can be used to influence subsequent checks — specifically, the path traversal validation that governs which files the sandbox may read.

The attack chain works as follows at the code level:

1. The attacker crafts an object that masquerades as a String (by proxying or spoofing the string prototype contract) but overrides match.
2. This object is submitted into a moment locale validation routine inside the sandbox. When moment calls match on the value, the attacker's function executes outside the expected sandbox constraints or with access to host primitives.
3. The same crafted object is re-used in a file-path check. The path traversal validation ordinarily rejects .. sequences or absolute paths that would escape the permitted directory. The faked match function causes the validation to behave incorrectly (for example, it can return crafted match results, or short-circuit the check entirely), allowing the validation to pass for paths that reference files outside the sandbox's intended directory.
4. The attacker references a malicious JavaScript file stored in the Flowise document store. The broken path validation permits loading this file, whose contents are then executed by the sandbox runner — but the execution context is outside the sandbox protective boundary, or the escaped references allow the payload to reach host APIs.

From a CWE perspective, this is classified as CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). The sandbox is designed to neutralize the effects of dynamic code evaluation; the flaw defeats that neutralization. Notably, vm2 is a security-sensitive component — any escape of this nature subverts the entire trust model of the Flowise custom-code feature.

Technical detail caveat: The NVD description does not disclose the internal function names, exact file paths, or the precise moment API call sites involved. The analysis above is therefore deliberately at the vulnerability-class and mechanism level. Specific implementation details of the exploit chain (e.g., whether the payload executes via runInNewContext, eval, or a host-function hoist) are not yet publicly documented for this CVE.

Exploitation Scenarios

No public proof-of-concept is currently available for CVE-2026-73602 (PoC status: UNKNOWN). The following attack chain is inferred from the NVD description and the established body of vm2 escape research. Treat this as a plausible exploitation model, not a confirmed exploit.

1. Reconnaissance and target identification. An attacker identifies an exposed Flowise instance (default web UI on TCP 3000, or behind a reverse proxy). Shodan-style fingerprinting (http.title:"Flowise", http.html:"flowise") or label-based searches (e.g., Hosted-GFM, favicon hashes) can reveal unauthenticated or weakly protected instances. The attacker then authenticates with a valid account; the NVD description explicitly states the exploitation requires an authenticated user.

2. Triggering the flaw. The attacker creates or imports a Flowise workflow containing a custom JavaScript node — the component evaluated inside the vm2 sandbox. The payload constructs a fake String object whose prototype overrides the match function, then feeds this object into the moment locale validation. This is performed from within the sandboxed code execution context, meaning the attacker needs only the ability to run approved custom code in a flow.

3. Payload and execution method. The attacker places a malicious JavaScript file in the document store (an upload or file attachment feature that persists user-supplied documents). Using the path traversal bypass obtained in step 2, the in-sandbox code references this document-store file using a path that the validation should have rejected. The sandbox loader reads the file and executes it. Because the path traversal check was bypassed, the file is resolved and executed outside the sandbox's designated working directory — escaping the vm2 boundary and executing in the context of the host Node.js process.

4. Post-exploitation impact. A successful escape yields arbitrary code execution as the operating system user running the Flowise service. Typical post-exploitation objectives include: reading environment variables and configuration files (LLM API keys, database credentials, vector-store credentials), accessing the document store contents, lateral movement within the hosting environment, and establishing persistence (e.g., a scheduled job or a reverse shell). The attacker may also tamper with production AI workflows, poisoning prompts or redirecting LLM outputs.

Note on inference: Because no public PoC exists and technical details are sparse, the exact method of translating the match-function bypass into code execution (e.g., whether the payload runs via eval, Function, or a host-constructor escape) cannot be stated with certainty. SOC teams should monitor for the broader behavioral pattern: unexpected file reads spanning directory boundaries plus child process creation or network beacons from the Flowise node process.

Impact Assessment

The business impact of CVE-2026-73602 is high, regardless of the absence of a published CVSS score. No CVSS vector or subscores are available (CVSS: N/A), so severity must be evaluated qualitatively.

• Affected systems: Flowise versions prior to 3.1.3 running the vm2 sandbox. Any deployment that allows authenticated users to author custom JavaScript workflows is affected. The OSV record lists the package as unfixed (0 → unfixed), which suggests the patch claim requires verification; deploy the fixed version (3.1.3) only after independent confirmation.
• Confidentiality impact: Full. The document store and host file system become readable; environment secrets, LLM API keys, and application data are exposed.
• Integrity impact: Full. The attacker can modify flows, tamper with documents, inject backdoors, and alter AI-assisted decision pipelines.
• Availability impact: Full. The attacker can terminate the service, consume resources, or deploy denial-of-service payloads.
• Blast radius: A single authenticated low-privilege user can compromise the entire Flowise host. In containerized or multi-tenant deployments, the blast radius may extend to adjacent services depending on container isolation and cloud IAM posture.
• Exploitation likelihood: EPSS score is 0.00437 (36.4th percentile of exploited CVEs), indicating a relatively low current exploitation probability. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code or Nuclei template exists. However, vm2 sandbox escapes are a well-studied class with a strong exploit-development community; once technical details are published, exploitation effort is expected to drop significantly.

Detection Guidance

The following detection content targets the behavioral fingerprint of CVE-2026-73602 exploitation: anomalous file-path resolution from the Flowise process, suspicious Node.js execution, and in-band HTTP payloads matching the crafted-object pattern. Indicators are generic because exact implementation details are unavailable; tune with local baselines.

Sigma Rule

title: Suspicious Node.js Child Execution from Flowise Process
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the Flowise/node process spawning a child Node.js process with script arguments containing path-traversal or eval-like patterns, potentially indicating CVE-2026-73602 sandbox escape.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73602
author: Valters IT Security
date: 2026/06/01
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/node'
            - '/flowise'
            - '/flowise-server'
    selection_child:
        Image|endswith: '/node'
        CommandLine|contains:
            - '--eval'
            - 'vm.runInNewContext'
            - '.js'
    selection_traversal:
        CommandLine|contains:
            - '..%2f'
            - '../'
            - '%2e%2e'
    filter_node_modules:
        CommandLine|contains: '/node_modules/'
    condition: selection_parent and selection_child and selection_traversal and not filter_node_modules
level: high
falsepositives:
    - Legitimate Flowise plugins executing scripts with relative paths containing '..'
tags:
    - attack.execution
    - attack.privilege_escalation
    - cve.2026.73602

YARA Rule

rule CVE_2026_73602_vm2_moment_locale_bypass
{
    meta:
        author = "Valters IT Security"
        description = "Detects JavaScript payloads matching the fake String object / match function / moment locale validation bypass pattern associated with CVE-2026-73602"
        cve = "CVE-2026-73602"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73602"
        date = "2026-06-01"
    strings:
        $s1 = "moment" ascii nocase
        $s2 = ".locale(" ascii nocase
        $s3 = "match" ascii
        $s4 = "prototype" ascii
        $s5 = "constructor" ascii
        $s6 = "arguments" ascii
        $s7 = "documentStore" ascii nocase
        $s8 = "vm2" ascii nocase
        $s9 = "runInNewContext" ascii
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x232F
        and 4 of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2026-73602 Flowise vm2 Sandbox Escape Attempt (moment locale bypass)"; flow:established,to_server; http.request_body; content:"moment"; nocase; http.request_body; content:"locale"; nocase; http.request_body; content:"match"; nocase; http.request_body; content:"constructor"; nocase; threshold:type limit, track by_src, count 1, seconds 300; classtype:attempted-admin; sid:600273602; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve CVE-2026-73602;)

Elastic Detection

// EQL query for Elastic Security
process where event.category == "process" and event.action == "exec"
  and process.parent.name in ("node", "flowise")
  and process.name == "node"
  and (
    process.args like "*--eval*"
    or (process.args like "*.js" and process.args like "*..*")
    or process.args like "*runInNewContext*"
  )

Splunk SPL Query

index=main sourcetype=ProcessRollup2 OR sourcetype=WinEventLog:Security
    (ParentImage="*\\node.exe" OR ParentImage="*\\flowise*" OR ParentName="node" OR ParentName="flowise")
    (Image="*\\node.exe" OR ProcessName="node")
    (CommandLine="*--eval*" OR CommandLine="*runInNewContext*" OR (CommandLine="*.js*" AND CommandLine="*../*"))
| stats count by host, ParentImage, Image, CommandLine, user
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="flowise,cve-2026-73602,">
  <rule id="602736" level="12">
    <if_sid>57100</if_sid>
    <field name="audit.data.syscall">execve</field>
    <field name="audit.data.argc" type="pcre2">\d+</field>
    <field name="audit.data.a0" type="pcre2">(?i)(node|flowise)</field>
    <field name="audit.data.a1" type="pcre2">(?i)(--eval|\.js)</field>
    <description>CVE-2026-73602: Suspicious node.js script execution from Flowise (sandbox escape indicator)</description>
    <group>execution,privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED): a single source (OSV) claims a fix is available in Flowise 3.1.3, but the claim is not independently confirmed. The OSV package record lists the affected package as unfixed (0 → unfixed), so treat the patch claim with caution and verify before relying on it.

Immediate mitigations:

1. Restrict authenticated access to Flowise to trusted personnel only. If the platform is internet-exposed, place it behind a VPN or an authentication reverse proxy with MFA.
2. Disable or remove custom JavaScript node functionality if it is not required for current business use — this directly removes the attack surface (the vm2 sandbox execution path).
3. Limit the document store: restrict file-upload permissions to trusted users and audit existing document-store entries for unexpected or unsigned JavaScript files.
4. Run the Flowise service under a dedicated, low-privilege OS account and containerize the workload with a read-only root file system and no host mounts containing secrets.

Patch and upgrade steps:

1. Upgrade Flowise to version 3.1.3 or later as soon as the patch claim is independently verified (check the vendor release notes and advisory page, and confirm the OSV record transitions to "fixed").
2. Maintain a rollback plan; if the upgrade introduces breaking changes, apply mitigations above while remaining on the vulnerable version.
3. After upgrading, verify the vm2 component version in the dependency tree and, where feasible, check whether the sandbox has been replaced or hardened.

Long-term hardening:

1. Plan a migration away from vm2, which is no longer maintained. Replace in-flow code execution with process-level isolation: separate worker threads, OS containers, or serverless functions with minimal IAM permissions.
2. Apply egress network controls so that even if code execution is achieved, the attacker cannot easily exfiltrate data (allowlist egress domains, block direct internet access from the Flowise pod).
3. Enforce strict filesystem access controls on the document store; the sandbox should be able to reference only a chrooted directory, never the host document store.
4. Subscribe to CVE and OSV feeds for Flowise and vm2, and incorporate this advisory into your vulnerability-management SLAs with the low-EPSS (0.00437) prioritization taken into account.

References

1. NVD Entry — CVE-2026-73602: https://nvd.nist.gov/vuln/detail/CVE-2026-73602
2. OSV Advisory — CVE-2026-73602 (patch source; single-source claim, confidence 2/4): https://osv.dev/vulnerability/CVE-2026-73602
3. CVE.org Record — CVE-2026-73602: https://www.cve.org/CVERecord?id=CVE-2026-73602
4. Flowise Project Repository (product reference; verify vendor advisory and release notes on the official repo): https://github.com/FlowiseAI/Flowise
5. CISA KEV Catalog — CVE-2026-73602 is NOT listed as of the report date; no known exploit-in-the-wild activity or threat-actor campaigns have been publicly documented.

No public exploit code, Nuclei template, or researcher write-up is currently available for CVE-2026-73602. The technical analysis and detection guidance in this report are based on the NVD description and vulnerability-class knowledge of vm2 sandbox escapes; monitor trusted research channels for a detailed write-up and update detections accordingly.