CVE-2026-70470 FlowiseAI CVE debrief

Who should care

Flowise users and administrators should assess their exposure and take immediate action to upgrade to version 3.1.3 or later. This involves reviewing the current deployment of Flowise, identifying potential vulnerabilities, and implementing necessary security measures to prevent exploitation. Additionally, users should review and restrict usage of Pyodide js module interop and implement additional security measures to prevent OS command execution. It is a

Why it matters

CVE-2026-70470 is a critical vulnerability in Flowise that allows for arbitrary Python execution and OS command execution. Flowise users and administrators should assess their exposure and take immediate action to upgrade to version 3.1.3 or later.

• Arbitrary Python execution inside Pyodide
• Full OS command execution on the Flowise host
• Potential for lateral movement and further exploitation

Technical summary

The validatePythonCodeForDataFrame function in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. This issue arises because JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time. As a result, homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents.

Defensive priority

High

Recommended defensive actions

• Upgrade to Flowise version 3.1.3 or later
• Review and restrict usage of Pyodide js module interop
• Implement additional security measures to prevent OS command execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the use of ASCII word-boundary blacklist in JavaScript regex, which can be bypassed by Unicode homoglyph identifiers. This allows for arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.