CVE-2026-70470

creationtimestamp| type| source ---|---|--- 2026-08-04 18:24:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbn3bud6i2i 2026-08-04 18:35:08+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2 2026-08-06...

CVE-2026-70470

Flowise CVE-2026-70470: Before version 3.1.3, the validatePythonCodeForDataFrame checker in Flowise allows bypass via Unicode homoglyphs in identifiers, circumventing the ASCII word-boundary blacklist and enabling arbitrary Python execution inside Pyodide with potential full OS command execution ...