The FalkorDB graph.UDF function in Redis module v4.20.1 to v4.20.4 is not registered as a write command. This misclassification causes the module to treat write operations as read‑only, leading to unpredictable or erroneous application behavior. The flaw may manifest as silent data corruption, failure to persist data changes, or internal logic errors, although the exact repercussions depend on the application usage pattern.

Affected systems are installations of FalkorDB Redis module version 4.20.1 through 4.20.4. No other vendors or products are listed. Systems running these versions are at risk if the graph.UDF command is invoked, as the command's true write nature is not recognized by the module.

The vulnerability carries a CVSS score of 7.1, indicating a high severity. EPSS is not available, so the likelihood of exploitation is uncertain. It is not listed in CISA's KEV catalog. The attack vector is likely remote, requiring control over the Redis instance to execute the graph.UDF command. Since the command is not flagged as a write operation, an attacker who can reach the Redis server (or users with write privileges) could potentially cause unexpected behaviour. No public exploits have been documented, but the risk remains significant for exposed Redis deployments.