CVE-2026-73484 is a sandbox escape vulnerability in Flowise before version 3.1.3. The vulnerability arises because the pythonCodeValidator.ts module does not properly block certain native Pandas DataFrame methods, including to_csv, to_json, pipe, and query. An attacker with authentication privileges can exploit this to access or exfiltrate sensitive CSV data uploaded to the system or write arbitrary files to the server, potentially compromising system integrity and confidentiality.

An authenticated attacker can leverage this vulnerability to exfiltrate sensitive data contained in uploaded CSV files or write arbitrary files to the server filesystem. This can lead to data leakage and potential further compromise of the server environment. The CVSS 4.0 score of 8.6 reflects a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.1.3, upgrading to version 3.1.3 or later (once confirmed by the vendor) is recommended. Until an official fix is available, restrict authenticated user capabilities and monitor for suspicious activity related to Pandas DataFrame method usage.