Threats tagged 'ghsa-vqrg-773h-4wxc'

Flexible GraphRAG contains a Cypher injection vulnerability due to incorrect string escaping in its FalkorDB adapter's _escape() function. The flawed escaping order allows crafted input to break out of string literals in Cypher queries, enabling injection of arbitrary Cypher clauses. This can lead to destructive actions such as wiping the entire graph database. The vulnerability affects versions from 0.6.0 up to but not including 0.8.2 and has been assigned CVE-2026-114510. A fix is available in version 0.8.2.