CVE-2026-114510

The record

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.

Affected packages

Related vulnerabilities

• CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
• CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
• CVE-2026-104368 The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege… CWE-116
• CVE-2026-118256 Vue I18n is the internationalization plugin for Vue.js. CWE-116
• CVE-2026-118257 Vue I18n is the internationalization plugin for Vue.js. CWE-116
• CVE-2026-110910 ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array… CWE-116
• CVE-2026-116582 Seroval facilitates JavaScript value stringification, including complex structures beyond… CWE-116
• CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-116