CVE-2026-40933 – Flowise
CVSS 9.9
CRITICAL
“A public exploit for a critical AI platform vulnerability can turn workflow automation into a direct attack path.”
FlowiseAI released a patch for a critical vulnerability affecting Flowise. CVE-2026-40933 has a CVSS score of 10.0, which is Critical severity.
The vulnerability involves improper command neutralization that could allow remote code execution in affected Flowise environments. Public proof-of-concept code is available. Successful exploitation could allow attackers to execute unauthorized commands, compromise AI workflows, and gain control of affected systems. The update strengthens input validation and command execution controls to reduce exposure.
Key Details
- Affected Product
- Flowiseai Flowise
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-78
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.