CVE-2026-70470
Received Received - Intake

Unicode Homoglyph Bypass in Flowise Enables Arbitrary Code Execution

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70470
EUVD
EUVD-2026-52811

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flowiseai flowise to 3.1.3 (exc)
flowiseai flowise 3.1.3
flowise flowise 3.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70470 is a critical vulnerability in Flowise versions 3.1.2 and earlier. It allows attackers to bypass a Python code validator using Unicode homoglyph identifiers, enabling arbitrary Python execution within Pyodide. This leads to full OS command execution on the Flowise host via Pyodide's JavaScript interop capabilities.

Detection Guidance

Check Flowise version with 'npm list -g flowise' or 'flowise --version'. Inspect pythonCodeValidator.ts for Unicode homoglyph bypasses in identifier validation. Monitor for unexpected Python code execution in Pyodide environments or unusual OS command activity from Flowise processes.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary commands on the Flowise host with the privileges of the Flowise process. This could lead to complete system compromise, including file access, credential theft, and network pivoting. Attackers can exploit it through public chatflows or user-controlled input without requiring privileges or user interaction.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized code execution and potential data breaches. It enables full system access, which could result in unauthorized data access, modification, or exfiltration, triggering mandatory breach notifications and regulatory penalties.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later immediately. Disable affected agents (CSV Agent and Airtable Agent) if upgrade is not possible. Implement network segmentation to limit Flowise host access. Review and restrict user permissions for Flowise processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart