The EPSS score of 0.00289 for CVE-2026-73484 should be treated with deep skepticism, and not because the vulnerability is minor. It's because the scoring model assumes 'authenticated attacker' means something it frequently doesn't in Flowise deployments.
Flowise is a no-code LLM application builder targeting data scientists, analysts, and business users who want to orchestrate RAG pipelines without writing code. In this context, authentication is a friction-reducer, not a security boundary. Many deployments run with default configurations, weak credentials, or shared accounts because that's the product's core value proposition: remove barriers. When a platform is designed to eliminate friction for non-technical users, the assumption that an authenticated attacker represents a meaningful hurdle doesn't hold. The 'authenticated' qualifier in the CVE is technically accurate but architecturally misleading — it implies integrity in an authentication layer that frequently has none in practice.
The technical flaw compounds this. The sandbox validator was catching dangerous patterns like eval() and exec() but missed Pandas native methods like to_csv() and to_json(). This isn't random oversight — it's the well-documented failure mode of pattern-matching sandboxes: block known dangerous keywords because that's what scanners flag, miss the fact that high-level library methods are themselves powerful primitives. This exact vulnerability class has recurred in Jupyter, Colab, Deepnote, and every Python sandbox that preceded Flowise. The genealogical pattern is clear: each platform inherits the keyword-blocklist approach and reproduces the same failure.
The arbitrary file write primitive is where this becomes serious. Flowise doesn't run in isolation — it connects to LLM providers (storing API keys), manages vector databases, and orchestrates RAG pipelines. A sandbox escape giving file write isn't primarily a data exfiltration bug. It's a foothold into a system with high-value targets: model configurations, embedding caches, cloud credentials from application configs, and the ability to poison downstream LLM outputs by modifying prompt templates or retrieval data. The blast radius is orders of magnitude larger than the raw CVSS suggests precisely because of what Flowise is — a hub connecting sensitive data sources and LLM infrastructure.
What to check: audit whether your Flowise instance enforces authentication properly (don't assume it does), review what credentials are stored in the application (API keys, database connections), and treat the Python sandbox as a layer above authentication rather than below it. The file write primitive gains value over time as deployments accumulate configuration and credential data — treat it as a dynamic risk, not a static one.