Dashboard / CVE-2026-73486

CVE-2026-73486

CRITICAL
INFO Priority: 0.06 BB Relevance: 68/100
Published: 2026-08-13 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
flowiseai flowise < 3.1.3

References & Advisories (2)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.66%
Raw Score 0.006620
Percentile 51.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00662
2026-10-28
0.00662

Intelligence Sources

nvd ref →

External Links