Description
The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.0.13
- Patched version(s): 3.1.0
References
Related Issues
- Flowise: Code Injection in CSVAgent leads to Authenticated RCE - CVE-2026-41137
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264
- Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains - CVE-2026-41271
- Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
You might also like:
- Tags:
- npm
- flowise-components
Anything's wrong? Let us know Last updated on April 24, 2026