What happened
Flexible GraphRAG's FalkorDB adapter assembles Cypher using a flawed escaping routine, so injected content can break string boundaries and inject Cypher clauses, enabling graph-data modification/deletion or disclosure when results are surfaced. CVSS 7.1, published 2026-10-22.
Why it matters
RAG pipelines ingest external documents and then feed LLM-extracted text into graph queries. A vulnerable query builder turns poisoned source content into a database-injection primitive that can alter or exfiltrate the knowledge graph an LLM retrieves from.
Attack vector
The _escape() helper escapes quotes before backslashes and the result is interpolated into Cypher assembled by FalkorDBAdapter.add_graph_documents. A doubling escape lets a quote terminate the string early; attacker-influenced document content gives the extraction model a malicious entity/relationship value that reaches the query. Dynamic node/relationship type identifiers are also inserted into backtick-quoted positions without safe parameterization.
Affected systems
flexible-graphrag (stevereiner) 0.6.0 to before 0.8.2 (FalkorDB adapter in the LangChain store)
Mitigation
Upgrade to flexible-graphrag 0.8.2 (GHSA-vqrg-773h-4wxc). Parameterize Cypher and treat extracted entity/relationship values as untrusted.