CVE-2026-70470: Flowise Python Code RCE Vulnerability

CVE-2026-70470 Overview

CVE-2026-70470 is a critical vulnerability in Flowise, a drag-and-drop user interface for building customized large language model flows. Versions prior to 3.1.3 contain a validator bypass in validatePythonCodeForDataFrame within packages/components/src/pythonCodeValidator.ts. Attackers can use Unicode homoglyph identifiers to defeat the ASCII word-boundary blacklist and execute arbitrary Python inside Pyodide. Through Pyodide's JavaScript module interop, this escalates into full operating system command execution on the Flowise host. The issue affects the CSV Agent and Airtable Agent nodes and is fixed in version 3.1.3.

Critical Impact
Unauthenticated attackers can bypass Python code validation using Unicode homoglyphs to achieve arbitrary code execution on the Flowise host via Pyodide js module interop.

Affected Products

Flowise versions prior to 3.1.3
Flowise CSV Agent node (packages/components/nodes/agents/CSVAgent/CSVAgent.ts)
Flowise Airtable Agent node (packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts)

Discovery Timeline

2026-08-04 - CVE-2026-70470 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-70470

Vulnerability Analysis

Flowise gates calls to pyodide.runPythonAsync in the CSV and Airtable agent nodes using a JavaScript regular expression blacklist implemented in validatePythonCodeForDataFrame. The blacklist targets dangerous Python dunder attributes and builtins such as __class__, __subclasses__, __base__, and __builtins__ using ASCII word-boundary matches. This validation gap is classified as [CWE-184] Incomplete List of Disallowed Inputs.

Attackers submit Python payloads through the LLM-driven agent that contain homoglyph variants of blocked identifiers. The validator accepts the payload as safe, then hands it to Pyodide. Pyodide's Python 3 runtime NFKC-normalizes the identifiers at parse time, converting the homoglyphs into their ASCII equivalents and evaluating them as the sensitive attributes the blacklist intended to block.

Once arbitrary Python runs inside Pyodide, the attacker uses the Pyodide js module interop to reach Node.js APIs on the host. This yields full operating system command execution in the Flowise process context.

Root Cause

The root cause is a mismatch between two Unicode processing models. JavaScript regular expression word boundaries (\b) are ASCII-only and do not recognize non-ASCII letter-like characters as word characters. Python 3, by contrast, applies NFKC normalization to identifiers during lexical analysis. Homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ therefore slip past the JavaScript blacklist but resolve to the forbidden ASCII identifiers inside the Python parser.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted natural-language query to an exposed Flowise CSV Agent or Airtable Agent. The LLM emits Python code containing homoglyph identifiers, the validator passes it, and Pyodide executes it. The attacker then pivots from Pyodide to host command execution through the js interop bridge.

typescript

// Patch context: the vulnerable Pyodide loader and system prompt removed in Flowise 3.1.3
// Source: https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c

-import type { PyodideInterface } from 'pyodide'
-import * as path from 'path'
-import { getUserHome } from '../../../src/utils'
-
-let pyodideInstance: PyodideInterface | undefined
-
-export async function LoadPyodide(): Promise<PyodideInterface> {
-    if (pyodideInstance === undefined) {
-        const { loadPyodide } = await import('pyodide')
-        const obj: any = { packageCacheDir: path.join(getUserHome(), '.flowise', 'pyodideCacheDir') }
-        pyodideInstance = await loadPyodide(obj)
-        await pyodideInstance.loadPackage(['pandas', 'numpy'])
-    }
-    return pyodideInstance
-}
-
-export const systemPrompt = `You are working with a pandas dataframe in Python. The name of the dataframe is df.
-...
-Security: Output ONLY pandas/numpy operations on the dataframe (df). Do not use import, exec, eval, open, os, subprocess, or any other system or file operations. The code will be validated and rejected if it contains such constructs.
-...`

Source: FlowiseAI/Flowise commit f4e2794. The patch removes the vulnerable Pyodide bootstrapping in the Airtable Agent core and replaces the flawed validation approach.

Detection Methods for CVE-2026-70470

Indicators of Compromise

Python payloads submitted to Flowise agent endpoints containing non-ASCII letter-like characters inside dunder identifiers such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, or __b𝐮iltins__.
Unexpected child processes spawned by the Node.js process hosting Flowise, particularly shells, curl, wget, or interpreters.
Outbound network connections from the Flowise host to unfamiliar destinations following CSV Agent or Airtable Agent activity.
New or modified files in the Flowise working directory or ~/.flowise cache that were not authored by administrators.

Detection Strategies

Inspect Flowise API request bodies for identifiers containing characters outside the ASCII range within Python source text.
Correlate CSV Agent and Airtable Agent invocations with subsequent process creation events on the Flowise host.
Alert on Pyodide execution paths that trigger js module interop calls reaching Node.js filesystem, child_process, or network APIs.
Baseline normal LLM-generated Python output and flag deviations that reference dunder attributes, even when they appear to contain typographical variants.

Monitoring Recommendations

Enable verbose logging on Flowise agent nodes and forward logs to a centralized SIEM for retention and query.
Monitor process lineage where the Flowise Node.js process is the parent, treating any shell or interpreter spawn as high severity.
Track egress network traffic from Flowise hosts and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-70470

Immediate Actions Required

Upgrade Flowise to version 3.1.3 or later without delay, as this release contains the official fix.
Restrict network exposure of Flowise instances so that only trusted users can reach the agent endpoints.
Audit historical Flowise logs for requests containing non-ASCII characters inside Python payloads.
Rotate any secrets, API keys, or credentials that were accessible from the Flowise host if compromise is suspected.

Patch Information

The vulnerability is fixed in Flowise 3.1.3. Review the GitHub Security Advisory GHSA-52fh-8v99-63c2, the remediation pull request #6499, and the Flowise 3.1.3 release notes for full technical details and deployment guidance.

Workarounds

Disable the CSV Agent and Airtable Agent nodes until the upgrade to 3.1.3 is complete.
Place Flowise behind an authenticating reverse proxy that enforces strong access controls on agent endpoints.
Run Flowise in a sandboxed container with minimal filesystem, network, and syscall privileges to limit the blast radius of Pyodide escape.

bash

# Upgrade Flowise to the patched release
npm install -g flowise@3.1.3

# Or, for Docker deployments, pin to the fixed version
docker pull flowiseai/flowise:3.1.3
docker stop flowise && docker rm flowise
docker run -d --name flowise -p 3000:3000 flowiseai/flowise:3.1.3