{"id":"EUVD-2026-25277","enisaUuid":"c7a3536f-170b-3b09-b02e-bf1eb12c22b6","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:10:37 PM","dateUpdated":"Apr 23, 2026, 8:20:30 PM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9wc7-mj3f-74xv\n","aliases":"CVE-2026-41137\n","assigner":"GitHub_M","epss":1.45,"enisaIdProduct":[{"id":"9913dcbf-facd-3643-ae51-58a6f055c81d","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"},{"id":"ca592dab-f6ec-3c02-8803-8d2ccf2ae11a","product":{"name":"flowise-components","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"enisaIdVendor":[{"id":"fffd8e60-8779-3361-97e1-d34cde60cce5","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"d3ec5653-1c93-3753-86dd-37f5ecb0f9e1","vulnerability":{"id":"CVE-2026-41137","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection payload that will get interpolated and executed by the server. This vulnerability is fixed in 3.1.0.","datePublished":"Apr 23, 2026, 7:10:37 PM","dateUpdated":"Apr 23, 2026, 8:20:30 PM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9wc7-mj3f-74xv\n","enisa_id":"EUVD-2026-25277\n","assigner":"GitHub_M","epss":1.45,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"77508f68-147e-3288-9ac6-7a86b2831502","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"},{"id":"a88699eb-3dcf-3f6d-8521-3a5adc942429","product":{"name":"flowise-components","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"07d70159-e1b3-342a-bcef-589a89d1e3f8","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}