CVE-2026-73487

The CVSS 9.0 rating on CVE-2026-73487 deserves scrutiny before you allocate patching resources. The EPSS score of 0.00389 signals that exploitation isn't straightforward—and examining why reveals practical friction points worth understanding. This vulnerability chains three distinct primitives: prompt injection to reach the validation layer, a regex bypass to survive it, and execution through an unauthenticated API endpoint. Each transition point introduces uncertainty. Prompt injection requires controlling a prompt in a specific way that passes regex validation. The regex bypass must land on an unblocked pandas function—and here the CVE's own description is revealing: pd.read_json() is the named vector. That's a data exfiltration tool, not a direct code execution primitive. Ask whether arbitrary code execution actually requires an additional step the CVE doesn't describe, or whether pd.read_json() reaching vector databases, credentials, and API keys was the intended end state all along. The unauthenticated prediction endpoint is the third constraint. Flowise deployments exposing this endpoint to the internet are not the default configuration in most enterprise deployments, which means the actual attack surface depends on your specific topology. The EPSS score likely reflects this narrower exposure profile rather than theoretical exploitability. What should shape your response: verify whether your Flowise instance exposes the prediction API without authentication—this is a configuration question, not just a patching question. Then assess what that node can reach: vector databases, cloud credentials, model training pipelines. The blast radius isn't the CVSS vector; it's what a compromised orchestration node touches. If the 3.1.3 patch adds pd.read_json() to a blocklist rather than replacing the regex validator with a proper sandbox (AST parsing, RestrictedPython, or a vetted execution environment), treat this as a temporary fix. Historical precedent with similar vulnerability classes—SSRF bypasses, NoSQL injection filters—shows that blocklist approaches create evolutionary pressure for the next bypass. Plan for iterative patching cycles. The time between patch availability and actual deployment in complex orchestration environments often spans 6-18 months, which is where exposure really persists.

Reviewed through automated stages and approved by a human before publication.