CVE-2026-70470

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description Flowise contains a flaw where the validatePythonCodeForDataFrame function in packages/components/src/pythonCodeValidator.ts can be bypassed using Unicode homoglyph identifiers. This occurs because the validator uses a JavaScript regex blacklist with word boundaries (b) that only recognize ASCII characters, whereas Python 3 normalizes these identifiers at parse time. Consequently, homoglyph versions of restricted terms such as class, subclasses, base, and builtins bypass the filter and are executed as their ASCII equivalents.

This bypass allows arbitrary Python execution within Pyodide, which can be leveraged via the Pyodide JS module interop to achieve full OS command execution on the Flowise host. The issue affects the pyodide.runPythonAsync function used in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts. Attackers can exploit this through the /api/v1/prediction/{chatflowId} endpoint or by modifying the customReadCSV variable in a chatflow.

Recommendations Update Flowise to version 3.1.3. As a temporary mitigation, restrict access to the CSVAgent and AirtableAgent components until the update is applied.