CVE-2026-114510highPrompt injection2026-10-22

CVE-2026-114510: poisoned documents can inject Cypher into Flexible GraphRAG's FalkorDB adapter and wipe the graph, upgrade to 0.8.2

Flexible GraphRAG 0.6.0 until 0.8.2 escaped quotes before backslashes in its LangChain FalkorDB adapter, so a quote can still end a Cypher string. Content in an ingested document can steer the extraction model into producing entity or relationship values that inject Cypher clauses, which can modify or delete graph data. The LlamaIndex FalkorDB store isn't affected.

01.

What it is

The _escape() helper in langchain/graph/pg_store_adapters/falkordb_adapter.py replaces ' before \, so the backslash it inserts gets doubled and the quote ends the string early.

The result is interpolated into Cypher built by FalkorDBAdapter.add_graph_documents. Node and relationship type names are also put into backtick-quoted positions without safe parameterization.

With GRAPH_BACKEND=langchain and GRAPH_DB=falkordb, attacker-influenced document content can make the extraction model emit malicious entity or relationship values that reach these queries.

Injected clauses can modify or delete graph data, and can disclose graph data when query results are shown to the user or the LLM.

02.

How to check

Check your flexible-graphrag version: 0.6.0 up to (not including) 0.8.2 is affected.
Check whether you run with GRAPH_BACKEND=langchain and GRAPH_DB=falkordb and ingest documents you don't fully trust.

03.

How to fix

Upgrade flexible-graphrag to 0.8.2 or later.
Until then, use the LlamaIndex FalkorDB store or another backend, or only ingest trusted documents, and keep backups of your graph.

pip install -U 'flexible-graphrag>=0.8.2'

04.

Sources

More advisories for this tool