Eval Injection in Flowise - CVE-2026-73602
Published: July 30, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU140074
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73602
CWE-ID: CWE-95
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the vm2-based JavaScript sandbox used by the custom function agent flow node and custom tool when executing user-supplied JavaScript. A remote user can submit crafted JavaScript that escapes the sandbox to execute arbitrary code.
Exploitation requires authentication and affects instances using the default vm2 sandbox.
Affected software
Flowise
How to mitigate CVE-2026-73602
Install security update from vendor's website.
Flowise - update to 3.1.3