THREAT OPS › Threat News › [NVD] CVE-2026-73602 (CRITICAL 9.9) — Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path tr
[NVD] CVE-2026-73602 (CRITICAL 9.9) — Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path tr
CVE-2026-73602 CVSS: 9.9 CRITICAL Published: 2026-08-13T12:17:24.480
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaS
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-73602cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73602