CVE-2026-114510: Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the escape() helper in flexible-graphrag/langchain/graph/pgstoreadapters/falkordbadapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.addgraphdocuments, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPHBACKEND=langchain and GRAPHDB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flexible-graphragto a version that resolves this vulnerability.Fixed in 0.8.2
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use Flexible GraphRAG versions from 0.6.0 until 0.8.2 with GRAPH_BACKEND=langchain and GRAPH_DB=falkordb. The LlamaIndex FalkorDB store is not affected.
What does an attacker need to exploit this issue?
An attacker needs to influence document content that is ingested by the application and have that content lead the extraction model to produce malicious entity or relationship values. Exploitation also depends on the vulnerable FalkorDB adapter being used.
What could an attacker do after successful exploitation?
Injected Cypher clauses can modify or delete graph data, including a full graph wipe. Graph data may also be disclosed if the calling code returns query results to a user or LLM.
What should be done if the affected adapter is in use?
Upgrade to version 0.8.2, which fixes the issue. Until upgrading, avoid using the vulnerable LangChain FalkorDB configuration for attacker-influenced document ingestion.