CVE-2026-41274

Flowise: Cypher Injection in GraphCypherQAChain

State: Published
Severity: 9.3 Critical
Published: Apr 23, 2026
Updated: Apr 24, 2026
Reserved: Apr 18, 2026

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-943 Improper Neutralization of Special Elements in Data Query Logic

Affected Products

Product	Versions
FlowiseFlowiseAI	< 3.1.0Affected
flowise-componentsFlowiseAI	< 3.1.0Affected

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.