CVE-2026-70470
published 2026-08-04CVE-2026-70470: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in…
PriorityP262critical9.5CVSS 4.0
AVNACHATNPRNUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.52%
42.3th percentile
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowiseai | flowise | < 3.1.3 | 3.1.3 |
| flowiseai | flowise | >= 0 < 3.1.3 | 3.1.3 |
| flowiseai | flowise-components | >= 0 < 3.1.3 | 3.1.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
ghsa·2026-08-04
CVE-2026-70470 [CRITICAL] CWE-184 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
### Summary
The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent).
### Details
packages/components/src/pythonCodeValidator.ts gates every call to pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts (lines 147, 198) and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts (line 186). The gate is a regex blacklist:
```ts
{ pattern: /\bimport\b/g, ... },
{
VulDB
FlowiseAI Flowise up to 3.1.2 Python Code Validator pythonCodeValidator.ts validatePythonCodeForDataFrame os command injection
vuldb·2026-08-04·CVSS 9.5
CVE-2026-70470 [CRITICAL] FlowiseAI Flowise up to 3.1.2 Python Code Validator pythonCodeValidator.ts validatePythonCodeForDataFrame os command injection
A vulnerability was found in FlowiseAI Flowise up to 3.1.2 and classified as critical. Affected by this issue is the function validatePythonCodeForDataFrame of the file packages/components/src/pythonCodeValidator.ts of the component Python Code Validator. The manipulation results in os command injection.
This vulnerability is cataloged as CVE-2026-70470. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626chttps://github.com/FlowiseAI/Flowise/pull/6499https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2
2026-08-04
Published