CVE-2026-41274 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.
A Cypher injection vulnerability has been identified in Flowise versions prior to 3.1.0, specifically within the GraphCypherQAChain node. This issue arises because user input is forwarded directly into the Cypher query execution pipeline without adequate sanitization. As a result, an attacker can inject arbitrary Cypher commands that are executed on the connected Neo4j database, potentially leading to unauthorized data access, modification, deletion, or exfiltration. The vulnerability is present in Flowise's core package and the flowise-components package, both of which are affected in versions through 3.0.13.
Users can upgrade to Flowise version 3.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | New CVE Received | [email protected] |