CVE-2026-70470: Critical Code Execution Bypass in Flowise

CVE-2026-70470 is a critical (CVSS 9.8) flaw in Flowise before version 3.1.3. A Python code validator can be bypassed with look-alike Unicode characters, which leads to arbitrary Python in Pyodide and command execution on the host. Upgrade the flowise and flowise-components packages to 3.1.3.

What's affected

The GitHub advisory lists two npm packages, flowise and flowise-components, with affected versions up to and including 3.1.2 and a patched version of 3.1.3. The NVD description agrees: prior to 3.1.3.

The vulnerable check is the function validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts. It gates the Python that runs inside the CSV Agent and Airtable Agent nodes. If you do not use either node, the vulnerable path is not in use for you, but upgrading is still the right move because the same release fixes several other issues.

The advisory also says this reopens two earlier fixes, GHSA-3hjv-c53m-58jj for the CSV Agent and GHSA-v38x-c887-992f for the Airtable Agent. In other words, a previous patch narrowed the problem without closing the class.

How to check if you're exposed

Find out which version you run.

npm ls flowise flowise-components

For a global install, add the -g flag. For Docker, check the image tag or run the container's own version command, and look at the tag you pulled, since latest may be older than you think.

docker ps --format "table {{.Names}}\t{{.Image}}"

Then see whether any chatflow uses a CSV Agent or Airtable Agent node. If an instance is reachable from the internet and has such a flow, treat it as urgent. The record's vector, AV:N/AC:L/PR:N/UI:N, says no login is needed to reach the vulnerable behavior.

What to do now

1. Upgrade flowise and flowise-components to 3.1.3 or later, and redeploy containers from a rebuilt or re-pulled image.
2. Make a list of chatflows that use the CSV Agent or Airtable Agent nodes, and consider disabling them until the upgrade is done.
3. Put the Flowise instance behind authentication and a network allowlist if it is open to the internet.
4. Run Flowise under a low privilege account or container with no access to secrets it does not need.
5. Rotate API keys and credentials stored in the instance if you cannot rule out misuse.
6. Check the 3.1.3 release notes for other security fixes that apply to you.

Why it matters

The record classifies the weakness as CWE-184, incomplete list of disallowed inputs. The validator is a blocklist of patterns. The advisory explains the gap: the JavaScript regular expression word boundary only understands ASCII letters, while Python normalizes identifiers when it parses them. A name written with look-alike characters slips past the pattern and is still read by Python as the blocked word.

That is the general trouble with blocklists. The defender has to name every bad form in advance, and the attacker only needs one the list missed. The sturdier designs are an allowlist of what generated code may do, or running such code in a sandbox that cannot reach the host at all. The advisory says the Pyodide bridge exposes the Node.js host, which turns a sandbox escape into command execution on the server.

The record does not say this is exploited, and the KEV flag is false. The reporter credit and technical detail are in the advisory, which is the right place for them.

Verifying the fix

After the upgrade, confirm the running process is the new one. A common slip with Node services is updating the files on disk while an old process keeps running, or pulling a new image tag while the orchestrator keeps the old container. Restart the service, then read the version from the running instance, not from the package file.

Next, think about the blast radius if the host were ever abused. The advisory says the Pyodide bridge exposes the Node.js host, which means the code runs with the privileges of the Flowise process. Anything that process can read, the injected code can read. That usually includes the API keys for model providers, database passwords and stored credentials for connected services. A short exercise helps: list what the Flowise account can reach, and remove what it does not need.

A note on blocklists

Security teams keep meeting this pattern with generated code. A validator that scans for dangerous words is tempting because it is quick to write and easy to explain, and it fails whenever the attacker finds a spelling the author did not think of. This advisory is a clean example, since the earlier patches for the same agents added more patterns and the next bypass still found a gap. When you review your own AI workflows, ask where model output becomes code, a query or a command, and whether the thing that runs it is an allowlist or a sandbox with real isolation.

The free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project you maintain pulls in an affected package, and the Gold vulnerability directory keeps the record for this CVE.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Flowise GitHub advisory GHSA-52fh-8v99-63c2
• Flowise 3.1.3 release
• Fix commit

Last reviewed: 19 October 2026.