- CVSS
- CRITICAL · 9.8v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 2026-08-04
- Weakness
- CWE-184
- Source
- nvd.nist.gov/vuln/detail/CVE-2026-70470
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as cl𝐚ss, subcl𝐚sses, b𝐚se, and b𝐮iltins bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.
References
- https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c
- https://github.com/FlowiseAI/Flowise/pull/6499
- https://github.com/FlowiseAI/Flowise/releases/tag/[email protected]
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2
How GTK Cyber trains on this
AI security training at GTK Cyber covers the LLM and ML-pipeline vulnerability classes that vulnerabilities like CVE-2026-70470 fall into. Our hands-on courses are taught by Charles Givre and other practitioners who break and defend production AI systems.