CVE-2026-73483criticalCode execution2026-08-13
CVE-2026-73483: Flowise custom functions could escape the sandbox through puppeteer.launch()
A logged-in Flowise user who can reach the custom function endpoint could break out of the NodeVM sandbox by passing their own executablePath and args to puppeteer.launch(), running OS commands as the Flowise process, which is root in the official Docker image.
What it is
Flowise runs custom JavaScript in the vm2/@flowiseai/nodevm sandbox and allows puppeteer inside it. puppeteer.launch() calls child_process.spawn() outside the sandbox, so attacker-chosen executablePath and args run any program.
The same route can read host files through Chromium's file:// handling.
In 3.0.8 through 3.1.2 this needs ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default.
How to check
- Affected: flowise and flowise-components (npm) <= 3.1.2.
- Check who can call /api/v1/node-custom-function and whether ALLOW_BUILTIN_DEP is set.
How to fix
- Upgrade Flowise to 3.1.3 or later.
- Don't run the Flowise container as root, and leave ALLOW_BUILTIN_DEP off unless you need it.
npm ls flowise flowise-componentsSources
More advisories for this tool