Flowise Pyodide Sandbox Bypass Reopens CSV/Airtable Agent RCE via Unicode Homoglyphs

What Happened

A newly published GitHub Security Advisory (GHSA-52fh-8v99-63c2, tracked as CVE-2026-70470) reports that Flowise's Python code validator can be bypassed using Unicode homoglyph identifiers, leading to remote code execution on the Flowise host. According to the advisory, the validatePythonCodeForDataFrame function relies on a regex blacklist to block dangerous constructs like __class__, __builtins__, and __subclasses__ before code is passed to pyodide.runPythonAsync in the CSV Agent and Airtable Agent nodes. The reported flaw is that JavaScript's \b word-boundary regex is ASCII-only, while Python 3 normalizes Unicode identifiers (per PEP 3131) at parse time. This lets an attacker submit identifiers built from Unicode look-alike characters (e.g. mathematical bold letters) that evade the regex but are normalized back to their dangerous ASCII equivalents by the Python interpreter. Per the advisory, this reopens two previously patched RCE paths (GHSA-3hjv-c53m-58jj and GHSA-v38x-c887-992f), effectively reintroducing critical-severity RCE in version 3.1.2.

Why It Matters

Per the advisory, any user who can reach a chatflow using the CSV Agent or Airtable Agent nodes — including unauthenticated users on public-facing chatflows — can achieve arbitrary OS command execution as the Flowise process. Two paths are described: an LLM-generated path, where a chat prompt coaxes the model into producing homoglyph-obfuscated Python, and a direct path, where a user with chatflow edit rights sets a malicious customReadCSV value. The advisory notes the underlying sink is the same one previously rated 9.8 critical, meaning organizations running Flowise 3.1.2 with these agent nodes exposed may face credential theft, internal network pivoting, and full compromise of multi-tenant deployments sharing the same host.

What Defenders Should Watch For

• Inventory Flowise deployments and confirm whether CSV Agent or Airtable Agent nodes are in use, particularly on chatflows reachable without authentication.
• Review outbound/host-level activity from the Flowise process for anomalous child-process execution, especially spawned via Node.js child_process shortly after prediction API calls.
• Hunt for unusual Unicode characters (e.g. mathematical alphanumeric symbol block, U+1D400–U+1D7FF) in chat inputs, stored chatflow configs, or LLM-generated code artifacts tied to CSV/Airtable Agent nodes.
• Restrict or disable public/unauthenticated access to chatflows using these agent types until a fix is confirmed available, and monitor Flowise's advisory page for a patched release.
• Treat any prior mitigation based solely on the original regex-blacklist validator as ineffective, since the advisory states it does not stop this bypass.

Developing Intel

This is a newly disclosed advisory and details may evolve as the vendor responds. This analysis is based solely on the information published in the advisory as of 2026-08-04; no independent verification of exploitation in the wild has been made. For full technical details, proof-of-concept code, and updates, see the original source: GHSA-52fh-8v99-63c2.