Flowise’s Python code validator can be bypassed by using Unicode homoglyphs such as __cl𝐚ss__ that normalize to ASCII identifiers, allowing an attacker to inject arbitrary Python code. The injected code is then executed through the Pyodide.js interop layer, and because Pyodide can run arbitrary OS commands, this flaw results in full remote code execution on the Flowise host. The vulnerability is a classic example of a bypass of input validation (CWE‑184).

The flaw applies to FlowiseAI’s Flowise product before version 3.1.3. Any deployment that has not upgraded past this release is susceptible to exploitation.

Flowise assigns a CVSS score of 9.5, indicating critical severity. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. The most likely attack vector is through the user interface or any API that accepts Python code strings; an attacker who can deliver a carefully crafted payload can bypass the validator’s ASCII‑only blacklist and achieve arbitrary code execution without needing elevated privileges beyond access to the Flowise UI.