Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M
CVE-2026-70470Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Critical 9.5
In plain English
A critical-severity security flaw in Flowise from FlowiseAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | 3.1.3 | GHSA-52fh-8v99-63c2 |
| npm | flowise-components | 3.1.3 | GHSA-52fh-8v99-63c2 |
Affected products (as reported)
Weakness: CWE-184 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2 x_refsource_CONFIRM
- https://github.com/FlowiseAI/Flowise/pull/6499 x_refsource_MISC
- https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c x_refsource_MISC
- https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 x_refsource_MISC