CVE-2026-46442

CVE-2026-46442 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including codeb0ssx. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains obfuscated Python code using PyArmor, a commercial code protection tool, with a suspicious binary payload in CVE-2026-46442.py. The pytransform module is used to load and execute encrypted code, which is atypical for legitimate PoCs and indicative of malicious intent.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.