External risk intelligence

Flowise Python Code Validation Bypass Allows OS Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-70470

Flowise is designed as a web-based user interface for building and deploying LLM workflows. It is commonly deployed as a web application or service that provides an interface for users, making its web-accessible components a standard part of its deployment model.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Flowise, a tool for building custom large language model flows. The flaw could allow an attacker to execute arbitrary Python code, leading to full operating system command execution on the host running Flowise. This is possible by bypassing a code validation mechanism through specially crafted Unicode characters.

Vulnerability allows code execution via special characters.
Matters for systems building and running AI workflows.
Confirm if Flowise is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by interacting with Flowise, likely through its web interface, without needing any prior access or authentication. The vulnerability is located in a Python code validation feature that is intended to prevent malicious code execution but can be bypassed. Successful exploitation allows an attacker to run arbitrary Python code within the application's environment, leading to the execution of operating system commands on the server hosting Flowise.

No authentication required.
Bypassing Python code validation.
Full OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary Python code within the Flowise environment, leading to the execution of OS commands on the host system when certain components are used. This could affect the integrity and availability of the Flowise service and the underlying host operating system.

System and user data at risk.
Bypass code validation to execute commands.
Compromise host system and services.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Flowise application, used for building LLM workflows, has a vulnerability that allows arbitrary Python and OS command execution. Application owners or platform teams responsible for Flowise deployments should initiate triage by identifying all instances of the affected software, confirming their exposure and criticality, and assigning ownership for remediation planning.

Identify Flowise instances and assess risk.
Confirm reachability and criticality of deployments.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flowise?

Flowise is a browser-based platform that provides a visual, drag-and-drop interface for developers to create and manage complex workflows involving large language models. It functions as an orchestration layer, helping users connect various data sources and AI components into functional pipelines.

What does CWE-184 mean for CVE-2026-70470?

CWE-184 refers to an incomplete blacklist vulnerability. In CVE-2026-70470, the software tries to block dangerous Python functions by looking for specific ASCII words. Because the validator fails to account for Unicode homoglyphs—characters that look like standard letters but have different digital representations—the system can be tricked into ignoring the blacklist and executing unauthorized code.

How can an attacker trigger this vulnerability?

An attacker triggers this by submitting specific Python code containing Unicode homoglyphs, such as modified versions of built-in Python identifiers, into the Flowise environment. This bypasses the filter, allowing the code to run. Simply using Flowise without interacting with components like the CSV or Airtable agents, or by not providing user-supplied Python code, does not trigger this specific flaw.

Do I need to worry if my Flowise instance is internal?

According to Halo Surface Signal, Flowise is designed as a web-based service, meaning its components are typically meant to be accessible. Even if a deployment is internal, it remains at risk if an attacker reaches the interface. You should prioritize assessment if your instance is network-reachable, as this allows potential interaction with the vulnerable Python validation component.

When should I update to version 3.1.3?

You should update to version 3.1.3 immediately. This release specifically addresses the validation bypass logic to properly detect and block the Unicode-based obfuscation techniques described. As a first step, identify all active Flowise deployments, verify their current versions, and coordinate with your team to schedule the upgrade to 3.1.3 to remove this security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.