CVE-2026-41274 is a critical injection vulnerability in FlowiseAI's Flowise product, specifically in versions before 3.1.0. The GraphCypherQAChain node forwards user input directly into Neo4j Cypher queries without proper neutralization of special elements, classified under CWE-943. This improper sanitization enables attackers to execute arbitrary Cypher commands on the underlying Neo4j database, risking data confidentiality and integrity. The vulnerability has a CVSS 4.0 score of 9.3, indicating high exploitability and impact. The issue is resolved in Flowise version 3.1.0.

Successful exploitation allows unauthenticated attackers to execute arbitrary Cypher commands on the Neo4j database used by Flowise, leading to potential data exfiltration, unauthorized data modification, or deletion. This compromises the confidentiality, integrity, and availability of the affected database. The vulnerability is critical due to its network attack vector, lack of required privileges or user interaction, and high impact on data security.

Upgrade Flowise to version 3.1.0 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory content are provided, users should verify the upgrade availability from FlowiseAI's official sources. Patch status is not yet confirmed beyond the stated fix version—check vendor advisories for current remediation guidance. Until upgraded, avoid exposing the vulnerable GraphCypherQAChain node to untrusted inputs.