CVE-2026-70470: Flowise Pyodide validator Unicode homoglyph bypass in CSV and Airtable Agents

CVE-2026-70470 · Severity: critical · CVSS 9.8 · Published 2026-08-04

Flowise is a visual AI agent builder that includes CSV and Airtable agents capable of executing Python code for data processing. A flaw in the Python code validator allows attackers to bypass security checks using Unicode characters that look identical to ASCII letters, enabling arbitrary Python execution and full remote command execution on the server with the privileges of the Flowise process. Any user accessing a public chatflow with these agents—including unauthenticated users—can exploit this to compromise the entire server and access sensitive credentials.

Technologies: flowise (npm), flowise-components (npm). Vendors: npm.

Quick answers

Is CVE-2026-70470 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70470 being exploited in the wild.
How severe is CVE-2026-70470?
Critical severity, with a CVSS score of 9.8, published 4 August 2026.
Which products and versions are affected?
flowise (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3; flowise-components (npm) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.3.
Is there a fix for CVE-2026-70470?
Yes. flowise (npm): upgrade to 3.1.3 or later; flowise-components (npm): upgrade to 3.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70470 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-70470?
Check whether you run flowise (npm) or flowise-components (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flowise (npm): upgrade to 3.1.3 or later
    npm install flowise@3.1.3
  • flowise-components (npm): upgrade to 3.1.3 or later
    npm install flowise-components@3.1.3

Technical details

The validatePythonCodeForDataFrame function in pythonCodeValidator.ts uses a blacklist of regex patterns to prevent dangerous Python constructs (import, __class__, __builtins__, etc.) before passing code to pyodide.runPythonAsync. The vulnerability exploits two design flaws: (1) JavaScript regex word boundary \b is ASCII-only and does not match Unicode letters, so __cl𝐚ss__ (with a mathematical bold 'a') bypasses the pattern \b__class__\b; (2) Python 3 applies NFKC normalization to all identifiers at parse time, so __cl𝐚ss__ is normalized to __class__ and executed as-is. Attackers can also assemble forbidden keywords via chr() calls to avoid literal pattern matches. The affected code paths are in CSVAgent.ts and AirtableAgent.ts, which validate LLM-generated Python code and customReadCSV configuration before execution. From within Pyodide running in Node.js, the js module interop allows access to process.mainModule.require('child_process').execSync, granting full OS command execution. A proof-of-concept demonstrates validator bypass and successful command execution. The fix in version 3.1.3 removes the vulnerable agents entirely.

Affected products

  • FlowiseAI Flowise <= 3.1.2
  • FlowiseAI flowise-components <= 3.1.2

Identifiers

  • CVE-2026-70470
  • GHSA-52fh-8v99-63c2

Timeline

  • 2026-08-04: disclosed: GHSA-52fh-8v99-63c2 published
  • 2026-06-11: patched: Fixed in version 3.1.3 by removing AirtableAgent and CSVAgent

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.