Flowise is a drag & drop user interface to build a customized large language model flow.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 23, 2026 · NIST NVD

   Detected

   Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.

Affected

• cpe flowiseai/flowiseversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-41137

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41137

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and ex

  nvd.nist.gov

References

• Exploit · github.com