---
id: CVE-2026-70470
title: >-
  Flowise is a drag & drop user interface to build a customized large language
  model flow
summary: >-
  Flowise is a drag & drop user interface to build a customized large language
  model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in
  packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode
  homoglyph iden…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-184
vendor: flowiseai
product: flowise
affected:
  - flowise < 3.1.3
patched:
  - flowise 3.1.3
published: '2026-08-04'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:19:38.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70470'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c
    label: security-advisories@github.com
  - url: 'https://github.com/FlowiseAI/Flowise/pull/6499'
    label: security-advisories@github.com
  - url: 'https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2
    label: security-advisories@github.com
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-52fh-8v99-63c2'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00972
epssPercentile: 0.60373
aliases:
  - GHSA-52fh-8v99-63c2
ecosystem: npm
ingestedAt: '2026-08-04T17:40:54.139Z'
---

## Overview

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.

## Affected

- `flowise < 3.1.3`

## Remediation

Upgrade past the affected range:

- `flowise 3.1.3`

## Package advisory (CVE-2026-70470)

Affected packages:

- `flowise <= 3.1.2`
- `flowise-components <= 3.1.2`

Patched in:

- `flowise 3.1.3`
- `flowise-components 3.1.3`

Source: https://github.com/advisories/GHSA-52fh-8v99-63c2