AI Threat AlertCVE-2026-73484: Flowise: Pandas sandbox bypass leaks files, writes to disk
UNKNOWNCISA: ATTENDFlowise's Python code sandbox (pythonCodeValidator.ts) blocks obviously dangerous calls but fails to block native Pandas DataFrame methods — to_csv, to_json, pipe, and query — letting an authenticated user pull uploaded CSV data out of the sandbox or write arbitrary files to the server filesystem. This is a real breach of the trust boundary that agent-building platforms like Flowise depend on: any low-privilege user with access to a Custom Function or code-execution node inherits far more capability than intended, and the flaw sits in a package with 156 other recorded CVEs and zero tracked downstream dependents, suggesting a pattern of weak input sanitization rather than a one-off bug. There's no CISA KEV listing, no public exploit or Nuclei template, and EPSS is 0.29% (79th percentile relative to all scored CVEs — meaningful in relative terms, low in absolute terms), so CISA SSVC rates it ATTEND: track and remediate on normal timelines, not an emergency. Upgrade to Flowise 3.1.3 or later, and in the interim restrict who can create or edit Custom Function / Python nodes and monitor outbound file writes from the Flowise container for unexpected paths or unexpected CSV egress.
What is the risk?
Medium risk in practice despite the absence of a published CVSS score. Exploitation requires an authenticated Flowise account, which caps the blast radius to insiders, compromised low-privilege credentials, or multi-tenant deployments where untrusted users share an instance — a realistic scenario for internal AI-agent-building platforms with broad developer access. Impact is high once triggered: exfiltration of uploaded CSV data (potentially containing sensitive business or customer data fed into agent workflows) and arbitrary file write, which can be chained into further compromise (e.g., overwriting config files or dropping a webshell if the write path is web-accessible). No active exploitation, KEV listing, or public PoC lowers urgency; CISA SSVC ATTEND and EPSS 0.29% both support a scheduled-patch posture rather than emergency response.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Flowise | npm | — | No patch |
Do you use Flowise? You're affected.
How severe is it?
What should I do?
1 stepUpgrade to Flowise 3.1.3 or later, which patches the pythonCodeValidator.ts blacklist to cover Pandas DataFrame I/O methods. Until patched, restrict access to Custom Function / Python code nodes to trusted administrators only, and avoid multi-tenant deployments where untrusted users can author flows. Audit existing flows for use of to_csv, to_json, pipe, or query on DataFrame objects. Add filesystem-level containment (run Flowise in a container with a read-only root filesystem and no access to sensitive host paths) as defense-in-depth, since blacklist-based sandboxes are inherently bypass-prone. Monitor for unexpected file writes from the Flowise process and for unusual outbound data patterns following code-node execution.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-73484?
Flowise's Python code sandbox (pythonCodeValidator.ts) blocks obviously dangerous calls but fails to block native Pandas DataFrame methods — to_csv, to_json, pipe, and query — letting an authenticated user pull uploaded CSV data out of the sandbox or write arbitrary files to the server filesystem. This is a real breach of the trust boundary that agent-building platforms like Flowise depend on: any low-privilege user with access to a Custom Function or code-execution node inherits far more capability than intended, and the flaw sits in a package with 156 other recorded CVEs and zero tracked downstream dependents, suggesting a pattern of weak input sanitization rather than a one-off bug. There's no CISA KEV listing, no public exploit or Nuclei template, and EPSS is 0.29% (79th percentile relative to all scored CVEs — meaningful in relative terms, low in absolute terms), so CISA SSVC rates it ATTEND: track and remediate on normal timelines, not an emergency. Upgrade to Flowise 3.1.3 or later, and in the interim restrict who can create or edit Custom Function / Python nodes and monitor outbound file writes from the Flowise container for unexpected paths or unexpected CSV egress.
Is CVE-2026-73484 actively exploited?
No confirmed active exploitation of CVE-2026-73484 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-73484?
Upgrade to Flowise 3.1.3 or later, which patches the pythonCodeValidator.ts blacklist to cover Pandas DataFrame I/O methods. Until patched, restrict access to Custom Function / Python code nodes to trusted administrators only, and avoid multi-tenant deployments where untrusted users can author flows. Audit existing flows for use of to_csv, to_json, pipe, or query on DataFrame objects. Add filesystem-level containment (run Flowise in a container with a read-only root filesystem and no access to sensitive host paths) as defense-in-depth, since blacklist-based sandboxes are inherently bypass-prone. Monitor for unexpected file writes from the Flowise process and for unusual outbound data patterns following code-node execution.
What systems are affected by CVE-2026-73484?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, data pipelines, code execution sandboxes.
What is the CVSS score for CVE-2026-73484?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0050Command and Scripting InterpreterAML.T0053AI Agent Tool InvocationAML.T0086Exfiltration via AI Agent Tool InvocationAML.T0097Virtualization/Sandbox EvasionCompliance Controls Affected
What are the technical details?
Original Advisory
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.
Exploitation Scenario
An attacker with a valid (even low-privilege) Flowise account builds or edits a flow containing a Custom Function or Python code node. Instead of using an obviously blocked call like os.system or open(), they write Python code that loads an uploaded CSV into a Pandas DataFrame and calls df.to_csv('/tmp/exfil.csv') or chains .pipe()/.query() to manipulate and write data outside the intended sandbox boundary — none of which pythonCodeValidator.ts's blacklist catches. The attacker then reads the written file through another Flowise feature (e.g., a file-serving endpoint or a subsequent node) to complete exfiltration of sensitive uploaded data, or writes to a path that lets them tamper with server configuration or plant a persistent file.
Weaknesses (CWE)
CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
- [Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2025-7133810.0Flowise: unauthenticated file write enables RCE
Same package: flowiseCVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same package: flowiseCVE-2025-619139.9Flowise: path traversal in file tools leads to RCE
Same package: flowiseCVE-2026-409339.9Flowise: RCE via MCP stdio command injection
Same package: flowiseCVE-2026-464429.9Flowise: sandbox escape enables authenticated RCE
Same package: flowise