CVE-2026-114510

Name of the Vulnerable Software and Affected Versions Flexible GraphRAG versions 0.6.0 through 0.8.1

Description The escape() helper in flexible-graphrag/langchain/graph/pg store adapters/falkordb adapter.py incorrectly escapes quotes before backslashes. This allows an inserted escape to be doubled and a quote to terminate a string prematurely when processed by FalkorDBAdapter.add graph documents. When GRAPH BACKEND is set to langchain and GRAPH DB is set to falkordb, malicious content in ingested documents can lead to the injection of Cypher clauses. This may allow an attacker to modify or delete graph data or disclose sensitive information if the results are returned to a user or Large Language Model (LLM). Additionally, dynamic node and relationship type identifiers are inserted into backtick-quoted query positions without safe parameterization.

Recommendations Update to version 0.8.2.