CVE-2026-41137

CVE-2026-41137 is a command injection vulnerability (CWE-94) affecting Flowise, an open-source drag-and-drop user interface for building customized large language model (LLM) flows. The flaw resides in the CSVAgent component prior to version 3.1.0, which permits users to supply custom Pandas CSV read code without adequate sanitization. This allows an attacker to craft a payload that gets interpolated and executed as a command on the server. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with low privileges.

An authenticated attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation enables arbitrary command execution on the server, granting high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U), such as data exfiltration, modification, or denial of service.

The official Flowise security advisory (GHSA-9wc7-mj3f-74xv) details the issue and confirms it is remediated in version 3.1.0. Practitioners should prioritize upgrading affected Flowise deployments to this patched release to mitigate the risk.

Flowise's focus on LLM flow orchestration underscores security considerations for AI/ML tools, where unsanitized code execution in agent components can expose production infrastructure. No public evidence of real-world exploitation is available as of the CVE publication on 2026-04-23.