CVE-2026-114510

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114510

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114510.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114510

Aliases

GHSA-vqrg-773h-4wxc

Published

2026-10-22T14:46:52Z

Modified

2026-10-23T02:45:48Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Details

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-116",
        "CWE-943"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114510.json"
}

References

Affected packages

Git / github.com/stevereiner/flexible-graphrag

Affected ranges

Type

GIT

Repo

https://github.com/stevereiner/flexible-graphrag

Events

Introduced

7c5da61f0472a07fe5c9ac495c19f52bbaeef87c

Fixed

9ace8d47e198ce3f15dbf22853e396ab4e9884fa

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.6.0"
                },
                {
                    "fixed":  "0.8.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "9ace8d47e198ce3f15dbf22853e396ab4e9884fa"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v0.8.2",
            "range":  [
                {
                    "fixed":  "9ace8d47e198ce3f15dbf22853e396ab4e9884fa"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.7.1

v0.7.2

v0.8.0

v0.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114510.json"