CVE-2026-73602 is a path traversal vulnerability in Flowise versions before 3.1.3 that enables sandbox escape through the vm2 JavaScript sandbox. The official CVSS score of 9.1 lists 'authenticated user' as a required context, but this framing obscures a fundamental design flaw: the users who authenticate to Flowise are the exact same users who need write access to the document store to build AI workflows. The authentication boundary provides zero practical security distance for the actual user population.
The vulnerability works by bypassing moment.js locale validation to traverse outside the intended sandbox directory and load arbitrary files. But the exploit only succeeds because of a deeper architectural problem: Flowise places user-writable storage inside the same trust domain that vm2 is supposed to isolate. Users who can write to the document store can already place files where the sandbox will execute them — the path traversal check was designed to prevent external attackers from loading files, not to constrain users who already have file system access by design.
This changes the severity assessment significantly. In Flowise's typical deployment — individual developers, small teams, shared development environments — authentication is a convenience control, not a security boundary. The relevant threat model isn't 'attacker with credentials,' it's 'what can an authenticated user already do because the product requires it?' The answer is: everything the sandbox escape enables.
Additionally, vm2 was publicly deprecated in 2024 after years of documented sandbox escape vulnerabilities. Flowise continued using an abandoned security-critical dependency with a known failure history. This represents a dependency hygiene failure independent of the specific path traversal bug.
For defenders: verify your Flowise version is 3.1.3 or later. More critically, audit whether Flowise instances have access to sensitive credentials, vector databases, or enterprise data pipelines — the sandbox escape gives code execution in a context that already trusts those connections. Consider whether vm2 can be replaced with a more robust sandbox like isolated-vm, or whether the architectural pattern of user-writable storage coexisting with sandboxed execution needs to be rethought entirely.