Which versions of Flowise are affected by EUVD-2026-52811?

Flowise before version 3.1.3 contains a critical remote code execution vulnerability in its CSV Agent and Airtable Agent components, enabling attackers to execute arbitrary operating system commands…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-52811?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52811. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-52811?

Within 24 hours, identify all Flowise deployments and determine whether CSV Agent or Airtable Agent nodes are actively used; disable these agent types if non-critical or restrict network access to the Flowise instance to authorized users only via firewall or identity-based controls, and audit recent logs for exploitation evidence. Within 7 days, conduct security investigation of any data processed through affected agents to determine if unauthorized code execution occurred; implement process isolation using containers or virtual machines to limit blast radius; and identify alternative tools for critical workflows. Within 30 days, monitor Flowise vendor advisories and GitHub repository for patch availability; establish policy to deploy patches within 48 hours of release; and evaluate long-term architectural changes to eliminate Python code execution in LLM orchestration platforms.

Flowise EUVD-2026-52811

Q: What is the CVSS score of EUVD-2026-52811?

EUVD-2026-52811 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-70470 CRITICAL

Incomplete List of Disallowed Inputs (CWE-184)

2026-08-04 GitHub_M

GHSA-52fh-8v99-63c2

Python Command Injection Flowise Flowiseai

9.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Network-reachable but AC:H because a reliable homoglyph payload must be forced through the LLM/config; S:C for Pyodide-to-host escape; full C/I/A on the compromised host.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 04, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Aug 04, 2026 - 18:01 vuln.today

Analysis Generated

Aug 04, 2026 - 18:01 vuln.today

CVE Published

Aug 04, 2026 - 17:30 cve.org

CRITICAL 9.5

DescriptionCVE.org

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.

Articles & Coverage 1

News Critical RCE in Flowise Python Sandbox via Unicode Homoglyph Bypass - CVE-2026-70470 Aug 05, 2026

AnalysisAI

Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDataFrame) can be defeated with Unicode homoglyph identifiers, letting an attacker run arbitrary Python that escapes the Pyodide sandbox and executes OS commands on the Flowise host with the process's privileges. The affected CSV Agent and Airtable Agent nodes gate LLM-generated (and config-supplied) Python through an ASCII word-boundary regex blacklist, which Python's NFKC identifier normalization silently rewrites back into the forbidden dunders. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the GitHub advisory documents a complete, reproducible bypass technique, so weaponization is straightforward; the vendor rates it 9.5 (CVSS 4.0).

Technical ContextAI

The vulnerability class is CWE-184 (Incomplete List of Disallowed Inputs): a denylist that fails to account for equivalent encodings. Flowise runs untrusted/LLM-authored Python inside Pyodide (CPython compiled to WebAssembly) embedded in the Node.js host, and gates every pyodide.runPythonAsync call in packages/components/nodes/agents/CSVAgent/CSVAgent.ts (lines 147, 198/209) and AirtableAgent/AirtableAgent.ts (lines 186/197) with a regex blacklist in packages/components/src/pythonCodeValidator.ts. Two behaviors collide: JavaScript regex \b word boundaries are computed only against the ASCII class [A-Za-z0-9_], so a character like U+1D41A (mathematical bold small a) is treated as a non-word character and \b__class__\b never matches __cl𝐚ss__; meanwhile Python 3 (PEP 3131) NFKC-normalizes identifiers at parse time, so __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ all resolve to their ASCII dunder equivalents. Dict string keys such as bi['__import__'] aren't normalized but can be assembled with chr() to dodge literal patterns. The classic escape __builtins__['__import__']('js') yields the JS host bridge, and process.mainModule.require('child_process').execSync then runs native commands on the host. The affected CPE is cpe:2.3:a:flowiseai:flowise (npm packages flowise and flowise-components).

RemediationAI

Vendor-released patch: 3.1.3 - upgrade both flowise and flowise-components to 3.1.3 or later (release: https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3; fix PR https://github.com/FlowiseAI/Flowise/pull/6499 and commit f4e2794f6a576b94578f2fdafbf49c2fb304626c). If you cannot upgrade immediately, the concrete compensating control is to remove or disable the CSV Agent and Airtable Agent nodes (both are flagged DEPRECATING and the fix effectively retires the Airtable Agent) and migrate to the AgentFlow Agent - the trade-off is loss of those specific CSV/Airtable query workflows. Additionally, place the Flowise prediction/chatflow endpoints behind authentication and network restrictions so untrusted users cannot invoke flows that reach pyodide.runPythonAsync, and run the Flowise process as a least-privileged, containerized user so a successful escape yields minimal host access - the trade-off is added operational overhead but it caps blast radius. Do not rely on the ASCII regex validator as a control, since NFKC normalization defeats it.