CVE-2026-73602

Katalog CVE

CVSS 9.9 · Critical EPSS 0,83%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada flowiseai flowise. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rqh4-rxw3-93rp exploit · advisory vendor
• https://www.vulncheck.com/advisories/flowise-before-sandbox-escape-to-rce advisory pihak ketiga
• https://github.com/FlowiseAI/Flowise/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 broken link