THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-52fh-8v99-63c2 (critical) — Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

[GHSA] GHSA-52fh-8v99-63c2 (critical) — Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

medgithub_advisoriesPublished 2026-08-04

GHSA-52fh-8v99-63c2 Severity: critical CVE: CVE-2026-70470

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

### Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-70470cve

Original source: https://github.com/advisories/GHSA-52fh-8v99-63c2