Flexible GraphRAG: Cypher injection through ingested document content on the FalkorDB backend

Impact

The _escape() helper escapes quotes before backslashes, so an inserted escape can be doubled and a quote can terminate the Cypher string early. Entity and relationship values produced by the extraction model from ingested documents are interpolated into queries built by FalkorDBAdapter.add_graph_documents, and dynamic node and relationship type identifiers go into backtick-quoted positions with no parameterization. An attacker who controls a document the pipeline ingests can inject Cypher clauses that modify or delete graph data, and where the calling code surfaces query results back to a user or to the LLM, read graph contents that caller was not meant to see. For a fleet running a shared RAG ingest service this means one uploaded file can corrupt the knowledge graph every tenant queries. Only the LangChain path is affected (GRAPH_BACKEND=langchain with GRAPH_DB=falkordb); the LlamaIndex FalkorDB store is not.

Who can reach it

Anyone who can get a document into the ingestion pipeline - an upload form, a crawled source, a watched share. Authentication depends on how the deployment exposes ingest; the CVSS vector records PR:L and UI:R, so the record assumes some privilege and a user action in the loop.

What to do

Upgrade to flexible-graphrag 0.8.2 and restart the ingest service - a Python package bump, no node maintenance. If you cannot upgrade now, switch GRAPH_DB off falkordb or the backend off langchain, and treat the existing graph as suspect: content ingested before the fix could already have altered or removed nodes.

References

Related entries

• vLLM: audio decompression bomb via input_audio or audio_url exhausts serving node memoryCVE-2026-116175 · vLLM (AudioMediaIO load_audio, missing max_duration_s limit)High
• vLLM: out-of-vocabulary stop_token_ids crash the engine and write past the V2 runner logits bufferCVE-2026-116181 · vLLM (OpenAI-compatible API, stop_token_ids validation)High
• NVIDIA TensorRT-LLM: server-side request forgery lets a local user make the serving process issue arbitrary requestsCVE-2026-24269 · NVIDIA TensorRT-LLM (server-side request forgery in the serving component)High
• vLLM (`MediaConnector`): SSRF, recurrence of CVE-2025-6242CVE-2026-24779 · vLLM (`MediaConnector`)High
• vLLM (`load_from_url_async`): Bypass of the CVE-2026-24779 SSRF fixCVE-2026-25960 · vLLM (`load_from_url_async`)High
• LangSmith SDK: pulling a public Hub prompt deserializes attacker-controlled LangChain objectsCVE-2026-45134 · LangSmith SDK (pull_prompt / pullPrompt manifest deserialization)High