CVE-2026-70470 in Flowise exposes a fundamental mismatch between how JavaScript and Python handle identifier validation. The platform uses JavaScript regex with ASCII-only word boundaries (\b) to validate code before passing it to Pyodide for execution. Python 3, however, normalizes identifiers via NFKC before parsing — converting Unicode mathematical script characters (U+1D400–U+1D7FF) to their ASCII equivalents. This means a homoglyph like 𝔸 (U+1D538) passes JavaScript validation as a non-word character but normalizes to 'A' in Python, enabling arbitrary code execution.
If you're defending Flowise deployments: first, confirm you're on version 3.1.3 or later. Second — and this is the critical check — examine whether the fix normalizes identifiers before validation or merely extends the blacklist of known homoglyphs. The difference determines whether this class of bypass is actually closed or merely patched against currently-known mutations. Ask the vendor directly: does the validator normalize Unicode to ASCII using NFKC before comparison, or does it still rely on JavaScript's native regex primitives?
The attack chain matters for severity assessment. The researcher demonstrated two hops: Python execution via Pyodide, then OS command execution via Pyodide's JavaScript module interop. If the second hop is architectural intended functionality rather than a sandbox escape, the vulnerability is actually a missing security boundary, not a broken one — and that has different implications for remediation.
Beyond this specific CVE, audit any platform that validates in one language runtime and executes in another. Unicode normalization divergence at cross-language boundaries is a systematic class, not an isolated flaw. The pattern — boundary-layer validation using the calling language's primitives against the executed language's semantics — has produced SQL injection, command injection, and now homoglyph bypasses. The fix isn't a better blacklist; it's moving validation into the execution context where the target language's own parsing rules apply.