Description
The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.13
- Patched version(s): 3.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: Cypher Injection in GraphCypherQAChain and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: Code Injection in CSVAgent leads to Authenticated RCE - CVE-2026-41137
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264
- Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains - CVE-2026-41271
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
You might also like:
See something that needs correcting? Let us knowUpdated April 24, 2026