Executive brief
Flowise is an open-source tool used to build customized AI workflows and chatbots. A security flaw in how it checks Python code allows attackers to bypass safety filters by using special Unicode characters that look like standard letters. This allows an attacker to execute unauthorized commands on the server hosting Flowise, potentially leading to a full system takeover, theft of sensitive credentials, or access to internal networks.
Technical details
The 'validatePythonCodeForDataFrame' function in 'pythonCodeValidator.ts' uses a regular expression blacklist to prevent dangerous Python execution. This validator can be bypassed because JavaScript's '\b' word boundary anchor is ASCII-only and fails to match Unicode homoglyphs (e.g., mathematical bold letters), while the underlying Python 3 environment (Pyodide) normalizes these characters into standard ASCII identifiers during parsing. An attacker can use these homoglyphs to access the 'js' module bridge in Pyodide, eventually reaching Node.js's 'child_process' to execute arbitrary shell commands. This vulnerability affects the CSV Agent and Airtable Agent components and can be triggered by unauthenticated users via public chatflows or by users with chatflow editing privileges.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-07-29: disclosed: Vulnerability reported to FlowiseAI
- 2026-08-04: advisory: GitHub Advisory published
- 2026-08-04: patched: Fixed in version 3.1.3