CVE-2026-70470

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Published Aug 4, 2026 CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.

Analysis

Technical impact

Flowise’s Python code validator can be bypassed by using Unicode homoglyphs such as __cl𝐚ss__ that normalize to ASCII identifiers, allowing an attacker to inject arbitrary Python code. The injected code is then executed through the Pyodide.js interop layer, and because Pyodide can run arbitrary OS commands, this flaw results in full remote code execution on the Flowise host. The vulnerability is a classic example of a bypass of input validation (CWE‑184).

Affected Systems

The flaw applies to FlowiseAI’s Flowise product before version 3.1.3. Any deployment that has not upgraded past this release is susceptible to exploitation.

Risk and Exploitability

Flowise assigns a CVSS score of 9.5, indicating critical severity. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. The most likely attack vector is through the user interface or any API that accepts Python code strings; an attacker who can deliver a carefully crafted payload can bypass the validator’s ASCII‑only blacklist and achieve arbitrary code execution without needing elevated privileges beyond access to the Flowise UI.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FlowiseAI

Flowise

affected

Version	Status	Constraints
`< 3.1.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Flowiseai

Flowise

Version	Status	Scheme	Platform
`[0,3.1.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Flowise to version 3.1.3 or later to apply the vendor‑supplied fix.
If you cannot upgrade immediately, limit or revoke the ability for users to submit Python code in Flowise components that rely on Pyodide, or sandbox such code execution in a separate environment.
Continuously monitor host activity for unexpected OS command execution or Python processes originating from Flowise, and enforce strict user access controls to prevent untrusted users from submitting code.

Generated by OpenCVE AI on August 4, 2026 at 19:37 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-52fh-8v99-63c2	Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.972% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c
https://github.com/FlowiseAI/Flowise/pull/6499
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2

History

Sep 14, 2026 9:00 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:flowiseai:flowise::::::::
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 4, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 4, 2026 7:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Flowiseai Flowiseai flowise
Vendors & Products		Flowiseai Flowiseai flowise

Aug 4, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.
Title		Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Weaknesses		CWE-184
References		https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c https://github.com/FlowiseAI/Flowise/pull/6499 https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2
Metrics		cvssV4_0 `{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`