CVE-2026-41274CWE-943

Flowise: Cypher Injection in GraphCypherQAChain

Critical · published April 23, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00735 · 53.9th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-04-23T21:12Z
EPSS history
Timeline
  • 23 APR 21:12Z
    Flowise: Cypher Injection in GraphCypherQAChain
    cvelistv5