Loading vulnerability…
Flowise Pyodide Unicode Homoglyph Validator Bypass RCE
CVE-2026-70470 is an incomplete blacklist-validation vulnerability in Flowise and flowise-components before 3.1.3. The validatePythonCodeForDataFrame routine attempts to block dangerous Python constructs before invoking Pyodide, including in CSVAgent and AirtableAgent execution paths. Its JavaScript regular expression uses ASCII-only word-boundary semantics, whereas Python 3 NFKC-normalizes identifiers when parsing. An attacker can therefore submit Unicode-homoglyph variants of blocked Python identifiers that evade validation but normalize to the prohibited identifiers at execution time. This enables arbitrary Python execution in Pyodide and can be escalated to host operating-system command execution through Pyodide JavaScript-module interoperation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables execution of arbitrary commands with the privileges of the Flowise process. An attacker may access files, credentials, tokens, and services reachable by that process; alter application data; and pivot to internal systems. In shared or multi-tenant deployments, compromise of the Flowise process may affect other tenants or workloads accessible from the host environment.
If you can’t patch tonight, do this now.
Until updates are deployed, disable or restrict chatflows that use CSVAgent or AirtableAgent, particularly publicly accessible flows. Prevent untrusted users from invoking or modifying affected flows, minimize the privileges and accessible secrets of the Flowise process, and restrict its network reachability to limit post-compromise access.
Patch, then assume compromise.
Upgrade Flowise and flowise-components to version 3.1.3 or later. This release fixes the Unicode-homoglyph bypass in the Python code validator.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.