CRITICAL🇵🇱 Wersja polska

CVE-2026-41274

CVSS 9.3v4.0pub. 2026-04-23upd. 2026-05-04

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The GraphCypherQAChain node in Flowise passes data supplied by the user directly to the Cypher query execution pipeline without proper sanitization. An attacker can craft a malicious payload containing arbitrary Cypher commands, which are then executed on the connected Neo4j database. The vulnerability is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), which means a lack of mechanisms separating data from query instructions.

Impact

An attacker requiring no authentication can exfiltrate, modify, or delete data stored in the Neo4j database connected to the Flowise instance.

Mitigation & patch

Update Flowise to version 3.1.0 or newer, in which the vulnerability has been fixed. Details are available in the vendor references at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc.

Who is affected

Flowise (FlowiseAI) in all versions prior to 3.1.0.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X