CVE-2026-70470

Flowise versions before 3.1.3 validate attacker-supplied Python code with an ASCII word-boundary blacklist regex in validatePythonCodeForDataFrame, which gates pyodide.runPythonAsync in the CSV Agent and Airtable Agent nodes. Because JavaScript regex word boundaries are ASCII-only while Python 3 NFKC-normalizes identifiers at parse time, homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, and __b𝐮iltins__ slip past the blacklist and are parsed as their dangerous ASCII equivalents. An unauthenticated attacker who can submit code to these agent nodes gains arbitrary Python execution inside Pyodide and, via Pyodide's JS module interop, full OS command execution on the Flowise host (CVSS 4.0: 9.5, no privileges or user interaction required). Self-hosted Flowise deployments running any version prior to 3.1.3 with the vulnerable agent nodes reachable are affected; the issue is fixed in 3.1.3. A public GitHub security advisory documents the technical details, but EPSS is low (0.8% over 30 days), the flaw is not in CISA's KEV, and no exploitation in the wild is known.

What to do: Upgrade Flowise to version 3.1.3 or later immediately. Until patched, place Flowise behind authentication and network access controls so untrusted users cannot reach the CSV Agent or Airtable Agent nodes, and consider disabling those nodes. Review host logs for unexpected Python or OS command execution originating from the Flowise process, and rotate any secrets or API keys accessible from the host.