Flexible Graphrag
Monthly
Cypher injection in Flexible GraphRAG 0.6.0 through 0.8.1 lets attacker-influenced document content reach FalkorDB queries when GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured. A crafted ingested document can steer the extraction model into producing malicious entity or relationship values, and the broken _escape() helper fails to neutralize a quote, allowing injected Cypher clauses to modify or delete graph data and, if the calling code surfaces query results to the user or LLM, disclose graph data. The assessed vector is CVSS 3.1 7.1 with AC:H, PR:L and UI:R; the maintainer demonstrated a proof-of-concept against a live FalkorDB instance that deleted every node, and the vendor released 0.8.2 with parameterized queries and backtick stripping.
Cypher injection in Flexible GraphRAG 0.6.0 through 0.8.1 lets attacker-influenced document content reach FalkorDB queries when GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured. A crafted ingested document can steer the extraction model into producing malicious entity or relationship values, and the broken _escape() helper fails to neutralize a quote, allowing injected Cypher clauses to modify or delete graph data and, if the calling code surfaces query results to the user or LLM, disclose graph data. The assessed vector is CVSS 3.1 7.1 with AC:H, PR:L and UI:R; the maintainer demonstrated a proof-of-concept against a live FalkorDB instance that deleted every node, and the vendor released 0.8.2 with parameterized queries and backtick stripping.