CVE-2026-41137

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

Vulnerability Details

Published Date

April 23, 2026

Last Modified

April 24, 2026

CWE ID

CWE-94

Source

NVD

Vendor

FlowiseAI

Product

Flowise, flowise-components

External References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9wc7-mj3f-74xv
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9wc7-mj3f-74xv

CVE-2026-41137

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment