CVE-2026-73602 is a critical vulnerability in Flowise prior to version 3.1.3 involving improper neutralization of directives in dynamically evaluated code, also known as 'Eval Injection'. The flaw exists in the vm2 JavaScript sandbox component, where an attacker with authentication can bypass moment locale validation by crafting a fake String object with a match function. This bypasses path traversal protections and enables loading and execution of malicious JavaScript files stored outside the sandbox environment, resulting in sandbox escape and arbitrary code execution.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the host running Flowise by escaping the vm2 sandbox. This can lead to full compromise of the application environment, data exposure, and potential further attacks on the underlying system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict authenticated user privileges and monitor for suspicious activity related to sandbox escape attempts.