CVE-2026-41274 - Flowise: Cypher Injection in GraphCypherQAChain

Back Back to CVE browser

CRITICAL

Flowise: Cypher Injection in GraphCypherQAChain

Published Apr 23, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.73%

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.

Affected products

Vendor FlowiseAI Product Flowise Default
n/a
- Version
  < 3.1.0
  Status
  affected
  Constraints
  -
Vendor FlowiseAI Product Flowise-Components Default
n/a
- Version
  < 3.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FlowiseAI

Flowise

n/a

Version	Status	Constraints
< 3.1.0	affected	-

FlowiseAI

Flowise-Components

n/a

Version	Status	Constraints
< 3.1.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	flowise	0	3.1.0
npm	flowise-components	0	3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-943

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25313
Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc
exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-28g4-38q8-3cwc
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41274

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25313		Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc		exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-28g4-38q8-3cwc		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41274