The Neo4jChatAgent component in Langroid passes LLM-generated Cypher queries directly to the Neo4j driver without any validation, statement-type allowlist, or opt-out mechanism. This lack of filtering allows attackers who can influence the prompt input (directly or indirectly via retrieval-augmented generation) to execute arbitrary Cypher queries. The read path uses session.run(query) with no validation, and the write path uses session.write_transaction(tx.run(query)) with only minimal substring checks that do not block dangerous queries. This contrasts with the SQLChatAgent, which enforces strict validation and an opt-in gate to prevent dangerous SQL operations. The vulnerability enables unauthorized data access and destruction, and when APOC or dbms.security procedures are enabled on the Neo4j server, it can lead to OS command execution and filesystem access. This is a prompt-to-Cypher injection vulnerability classified under CWE-74 and is a critical security issue. The affected versions are all Langroid versions before 0.65.5. No official patch or fix is currently documented.

An attacker who can influence the prompt input to the Neo4jChatAgent can execute arbitrary Cypher queries on the Neo4j database. At minimum, this allows unauthorized reading of all graph data, full write and destructive operations (including deleting all nodes), and SSRF via LOAD CSV remote fetch. If the Neo4j server has APOC or dbms.security procedures enabled and granted to the database role, the attacker can execute OS commands and access the filesystem, effectively achieving remote code execution. This vulnerability can lead to complete compromise of the graph database and underlying host system, depending on server configuration.

No official patch or fix is currently documented for this vulnerability. Users should consider disabling or restricting the use of Neo4jChatAgent until a fix is available. Applying strict validation and allowlisting of Cypher queries before execution, similar to the SQLChatAgent's approach, is recommended as a mitigation strategy. Monitor vendor advisories for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.