Flowise Pyodide Sandbox Escape via Unicode Homoglyph Validator Bypass (RCE)

Technical Analysis

The validator in pythonCodeValidator.ts uses regex patterns with \b word boundaries to block sensitive identifiers such as __class__, __subclasses__, and __builtins__ before code reaches pyodide.runPythonAsync in CSVAgent.ts and AirtableAgent.ts. JavaScript's \b treats only ASCII word characters as boundaries, so a Unicode homoglyph character embedded in an identifier (e.g., U+1D41A instead of ASCII 'a') prevents the blacklist regex from matching, while Python's PEP 3131 NFKC normalization silently converts the identifier back to its ASCII form at parse time, restoring the blocked semantics. This allows an attacker-controlled or LLM-generated pythonCode string to reach class hierarchy traversal (__class__.__mro__ / __subclasses__) or reconstruct __builtins__['__import__'] via chr()-assembled strings to import the 'js' module, which in the Node.js Pyodide host exposes process.mainModule.require('child_process').execSync — granting native OS command execution with Flowise's process privileges. The entry point is any prompt or node configuration path that feeds text into the CSV/Airtable Agent's Python code generation (customReadCSV config or LLM-produced pythonCode), meaning both a malicious end user and a manipulated/compromised LLM output can trigger the escape, crossing from a supposed 'sandboxed data-analysis' tool boundary into full host compromise.

Affected Systems

Flowise, flowise-components

Detection Signatures

• Python/pythonCode strings containing non-ASCII letters interleaved with underscores or dunder-style tokens (e.g., mixed mathematical alphanumeric symbols U+1D400–U+1D7FF near identifiers like __class__, __builtins__, __subclasses__, __mro__, __base__)
• Use of chr() concatenation to build strings resembling '__import__' or 'js' within CSV/Airtable Agent pythonCode fields
• Pyodide invocation (pyodide.runPythonAsync) immediately following a 'valid: true' result from validatePythonCodeForDataFrame with unusual Unicode codepoints in the input
• Unexpected child_process/execSync activity spawned by the Flowise Node.js process shortly after CSV/Airtable Agent execution
• Outbound or local OS commands originating from a process with Flowise's working directory or user context

Remediation Steps

1. 1

   Upgrade Flowise

   Update flowise and flowise-components to a patched version beyond 3.1.2 once available; monitor the GHSA-52fh-8v99-63c2 advisory for the fix release.

2. 2

   Normalize before validating

   Apply Python-equivalent Unicode NFKC normalization (and strip/reject non-ASCII identifier characters) to all code strings before running blacklist regex checks, ensuring the validator sees what the interpreter will actually execute.

3. 3

   Replace blacklist with allowlist

   Move from a denylist regex approach to a strict allowlist of permitted syntax/operations for LLM-generated Python code, rejecting any code containing dunder attributes, string concatenation building sensitive names, or non-printable/non-ASCII identifiers.

4. 4

   Harden Pyodide host bridge

   Disable or restrict the 'js' module interop and any access to Node.js process/child_process objects from within the Pyodide runtime, or run Pyodide in a separate, unprivileged process/container with no filesystem or child_process access.

5. 5

   Sandbox isolation

   Run CSV/Airtable Agent code execution in an isolated, least-privilege container or VM separate from the main Flowise process so a sandbox escape does not yield host-level command execution.

6. 6

   Audit and monitor

   Add runtime monitoring for unexpected child_process spawns from the Flowise process and alert on Python code containing suspicious Unicode ranges in agent tool inputs.