Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-70470
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses Flowise, a drag and drop tool for building apps that use AI language models, at any version before 3.1.3. The problem is in a safety check meant to block dangerous Python code in two building blocks: the CSV Agent, which works with data files, and the Airtable Agent. By using look-alike characters, an attacker can slip past this check, run any Python code they choose, and then run commands on the computer that hosts Flowise. This flaw is rated Critical.
What to do
- The person who installed or runs Flowise for your organization (a staff member, a volunteer, or your IT provider) should handle this flaw.
- If you run Flowise yourself, update it to version
3.1.3or later, which fixes this flaw. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update to
3.1.3will be done. - If you are not sure whether your organization uses Flowise, ask the person who looks after your computers or online tools to check, and to find out which version is running.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.