CVE-2026-73485

The CVSS 9 rating for CVE-2026-73485 measures a specific blocklist bypass, but the more important takeaway is that blocklisting for code execution was never a viable security boundary in the first place. Flowise's pythonCodeValidator was security theater — a regex-based filter sitting in front of Pyodide, which was never designed as a security isolation layer. Pyodide is a Python runtime compiled to WebAssembly for browser compatibility, not a hardened sandbox with syscall filtering or process isolation. Calling it "unsandboxed pyodide with full access to the host operating system" in the disclosure indicates the sandboxing was either absent or already known to be non-functional. The bypass technique matters less than the architectural decision that made such a bypass possible: Flowise's design allowed arbitrary Python execution in a workflow orchestrator without genuine isolation. If your deployment uses Flowise's code execution nodes, the immediate question is whether arbitrary Python execution fits your threat model at all. It likely doesn't. The correct security posture is either strict input validation using an actual sandbox — properly configured containerization with namespace isolation and seccomp profiles, or a WASM sandbox with genuine syscall filtering — or removing the feature entirely. A blocklist validator against code injection is not a security control; it's a delay mechanism that fails exactly as decades of vulnerability history predict. The blast radius of this class of vulnerability deserves separate consideration. Flowise is a workflow orchestrator designed to chain LLM integrations, database connectors, HTTP clients, and code execution nodes. A compromised code execution node in this architecture isn't a contained RCE — it's a pivot point into every connected system. If your Flowise instance has access to internal databases, API credentials, or other services, the attack path from 'bypassed pythonCodeValidator' to 'full internal network compromise' may be a single hop. Rate this vulnerability in the context of what an attacker who gains code execution can reach, not just the technical severity of the bypass. Finally, consider the maintenance posture. Security controls on execution primitives that nobody actively maintains accumulate technical debt. The pythonCodeValidator likely went from 'good enough for internal testing' to shipped feature without revisit, calcifying a threat model answer that may have only been correct for an early-stage tool. Treat any execution-node feature in your dependencies as requiring active threat model review — not a one-time decision.

Reviewed through automated stages and approved by a human before publication.