Flowise CVE-2026-70470

Exploitation requires a Flowise deployment (<= 3.1.2) that has a CSV Agent or Airtable Agent node configured and reachable, and the attacker must be able to get crafted Python into that node - either by controlling the CSV Agent's customReadCSV node configuration or by manipulating the LLM (prompt injection through the flow's input) so it emits Python containing NFKC-normalizable homoglyph identifiers (e.g. __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, __b𝐮iltins__) plus chr()-assembled dict keys for '__import__'. Limiting factors: the vulnerable code paths are the deprecated CSV/Airtable Agent nodes (not present in every deployment), successful attacks depend on reliably steering the LLM or config into the exact homoglyph payload (hence CVSS AC:H), and the host must run Flowise on Node.js where the Pyodide js bridge exposes process.mainModule.require. Whether authentication is actually needed depends on whether the chatflow endpoint is exposed unauthenticated (the vendor vector assumes PR:N).

This regression reopens the RCE paths previously patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent), and the impact is maximal: full host command execution with sandbox escape (CVSS 4.0 9.5, VC/VI/VA:H and subsequent-system SC/SI/SA:H). The vendor vector marks AC:H, PR:N, UI:N, AT:N - network-reachable and unauthenticated in principle, but the AC:H honestly reflects that an attacker must reliably get homoglyph-laden Python to the runPythonAsync call, either by controlling the CSV Agent's customReadCSV node configuration or by steering the LLM (prompt injection) into emitting the crafted code. No EPSS score and no KEV entry were provided, and no explicit POC flag is set, so I cannot claim active exploitation; however, the advisory's step-by-step bypass materially lowers the barrier and this should be treated as a real, high-priority patch item wherever CSV/Airtable Agent nodes are exposed. Note the tension to verify: PR:N assumes a publicly reachable chatflow prediction endpoint - if your Flowise instance requires authentication to invoke flows, effective privilege requirements are higher than the raw vector implies.

An attacker sends a query to a network-exposed Flowise chatflow that uses the CSV or Airtable Agent, using prompt injection (or a poisoned customReadCSV config) to make the generated Python contain homoglyph dunders like __cl𝐚ss__ and __b𝐮iltins__. The validator's ASCII \b regex fails to match, Python NFKC-normalizes the identifiers, and __builtins__['__import__']('js') reaches the Node host bridge, invoking child_process.execSync to run commands as the Flowise process. No public exploit is identified yet, but the advisory provides a full working bypass technique.