CVE-2026-70470: Flowise Unicode homoglyph bypass

Q: Is CVE-2026-70470 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70470, increasing the risk of exploitation.

Q: How to fix CVE-2026-70470?

Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix, since it corrects the validator to normalize identifiers before blacklist checking. If immediate patching isn't possible, disable or remove the CSVAgent and AirtableAgent nodes from available flow components, or restrict flow-creation/editing privileges to fully trusted operators only. For detection, monitor Pyodide/Python execution logs for non-ASCII or mathematical-alphanumeric Unicode characters in identifiers (a strong indicator of homoglyph evasion attempts), and monitor the Flowise host process for unexpected child process spawning or outbound network connections following agent node execution, since successful exploitation results in genuine OS command execution outside the sandbox.

Q: What systems are affected by CVE-2026-70470?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed code execution, low-code/no-code AI builders.

Q: What is the CVSS score for CVE-2026-70470?

No CVSS score has been assigned yet.

CISO Take

Flowise's Python code validator, meant to block dangerous identifiers like __class__ or __builtins__ before code reaches its embedded Pyodide sandbox, only checks ASCII word boundaries — so an attacker can swap in visually identical Unicode homoglyphs (like __cl𝐚ss__) that the JavaScript regex ignores but Python 3 silently normalizes back to the blocked form at parse time. This matters because the bypass isn't theoretical: it chains directly into full OS command execution on the Flowise host via Pyodide's JS interop, and a public PoC already exists for a platform carrying 158 other tracked CVEs, suggesting it's a frequently probed target. There's no CISA KEV listing and CISA's SSVC guidance lands at ATTEND rather than immediate action, with EPSS in the top 58% of scored CVEs — not the highest tier, but well above background noise for a pre-auth-adjacent RCE chain. Any self-hosted Flowise instance below 3.1.3 that exposes CSVAgent or AirtableAgent nodes to less-trusted flow builders should upgrade immediately; until then, disable or restrict those two nodes and treat flow-authoring access as equivalent to host shell access.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS

What is the risk?

Technical severity is critical despite the absence of a published CVSS score: the flaw grants full arbitrary OS command execution on the Flowise host, not just sandbox-contained code execution. Exploitability is real-world proven — a public PoC exists — but requires the attacker to have access to configure or inject Python code into a CSVAgent/AirtableAgent flow, which typically means an authenticated flow-builder role or a flow that ingests untrusted CSV/Airtable-driven input. EPSS (top 58th percentile) and CISA SSVC (ATTEND) both suggest moderate rather than imminent mass-exploitation pressure, and it is not in CISA KEV, so there's no evidence of active exploitation in the wild yet. Given the exploit is public and the impact is full host compromise, risk should be treated as high for any internet-facing or multi-tenant Flowise deployment.

How does the attack unfold?

Malicious Flow Configuration

Adversary configures a Flowise CSVAgent or AirtableAgent node with Python code using Unicode homoglyph identifiers (e.g., __cl𝐚ss__) instead of the blacklisted ASCII forms.

AML.T0053

Validator Bypass

The ASCII-only regex blacklist fails to flag the homoglyph identifiers, letting the payload pass into the Pyodide execution path.

AML.T0107

Sandbox Traversal

Python 3's NFKC normalization resolves the homoglyphs to their real ASCII equivalents at parse time, letting the code walk __class__ → __subclasses__ → __base__ → __builtins__ inside Pyodide.

AML.T0050

Host Command Execution

Using Pyodide's JavaScript interop layer, the adversary breaks out of the sandbox and executes arbitrary OS commands on the Flowise host, achieving full remote code execution.

AML.T0112

Malicious Flow Configuration

Adversary configures a Flowise CSVAgent or AirtableAgent node with Python code using Unicode homoglyph identifiers (e.g., __cl𝐚ss__) instead of the blacklisted ASCII forms.

AML.T0053

Validator Bypass

The ASCII-only regex blacklist fails to flag the homoglyph identifiers, letting the payload pass into the Pyodide execution path.

AML.T0107

Sandbox Traversal

Python 3's NFKC normalization resolves the homoglyphs to their real ASCII equivalents at parse time, letting the code walk __class__ → __subclasses__ → __base__ → __builtins__ inside Pyodide.

AML.T0050

Host Command Execution

Using Pyodide's JavaScript interop layer, the adversary breaks out of the sandbox and executes arbitrary OS commands on the Flowise host, achieving full remote code execution.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch
Flowise	npm	<= 3.1.2	`3.1.3`
Flowise	npm	<= 3.1.2	`3.1.3`

How severe is it?

CVSS 3.1

N/A

EPSS

0.9%

chance of exploitation in 30 days

Higher than 57% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix, since it corrects the validator to normalize identifiers before blacklist checking. If immediate patching isn't possible, disable or remove the CSVAgent and AirtableAgent nodes from available flow components, or restrict flow-creation/editing privileges to fully trusted operators only. For detection, monitor Pyodide/Python execution logs for non-ASCII or mathematical-alphanumeric Unicode characters in identifiers (a strong indicator of homoglyph evasion attempts), and monitor the Flowise host process for unexpected child process spawning or outbound network connections following agent node execution, since successful exploitation results in genuine OS command execution outside the sandbox.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.2 - Information security for AI system components

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-70470?

Flowise's Python code validator, meant to block dangerous identifiers like __class__ or __builtins__ before code reaches its embedded Pyodide sandbox, only checks ASCII word boundaries — so an attacker can swap in visually identical Unicode homoglyphs (like __cl𝐚ss__) that the JavaScript regex ignores but Python 3 silently normalizes back to the blocked form at parse time. This matters because the bypass isn't theoretical: it chains directly into full OS command execution on the Flowise host via Pyodide's JS interop, and a public PoC already exists for a platform carrying 158 other tracked CVEs, suggesting it's a frequently probed target. There's no CISA KEV listing and CISA's SSVC guidance lands at ATTEND rather than immediate action, with EPSS in the top 58% of scored CVEs — not the highest tier, but well above background noise for a pre-auth-adjacent RCE chain. Any self-hosted Flowise instance below 3.1.3 that exposes CSVAgent or AirtableAgent nodes to less-trusted flow builders should upgrade immediately; until then, disable or restrict those two nodes and treat flow-authoring access as equivalent to host shell access.

Is CVE-2026-70470 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-70470, increasing the risk of exploitation.

How to fix CVE-2026-70470?

Upgrade flowise and flowise-components to 3.1.3 or later immediately — this is the only complete fix, since it corrects the validator to normalize identifiers before blacklist checking. If immediate patching isn't possible, disable or remove the CSVAgent and AirtableAgent nodes from available flow components, or restrict flow-creation/editing privileges to fully trusted operators only. For detection, monitor Pyodide/Python execution logs for non-ASCII or mathematical-alphanumeric Unicode characters in identifiers (a strong indicator of homoglyph evasion attempts), and monitor the Flowise host process for unexpected child process spawning or outbound network connections following agent node execution, since successful exploitation results in genuine OS command execution outside the sandbox.

What systems are affected by CVE-2026-70470?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed code execution, low-code/no-code AI builders.

What is the CVSS score for CVE-2026-70470?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandboxed code executionlow-code/no-code AI builders

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.

Exploitation Scenario

An adversary with flow-authoring access (or access to a flow accepting untrusted CSV/Airtable input) configures a CSVAgent or AirtableAgent node with Python code containing homoglyph identifiers such as __cl𝐚ss__ or __b𝐮iltins__ instead of their ASCII originals. Flowise's regex-based blacklist, which only matches ASCII word boundaries, lets the code through unflagged. When Pyodide parses and executes the code, Python 3's NFKC normalization silently resolves the homoglyphs to their real ASCII equivalents, letting the payload walk the object hierarchy (__class__ → __subclasses__ → __base__ → __builtins__) to reach OS-level primitives. From there, the adversary uses Pyodide's JavaScript interop layer to break out of the sandbox and execute arbitrary OS commands directly on the Flowise host, achieving full remote code execution.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.