← Database

CVE-2026-73484

N/A CVSS: N/A Published: 2026-08-13 Modified: 2026-08-13

Description

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

Affected Platforms

Unknown

Weakness Type

CWE-184

References