{"data":{"id":"1b20ad9f-70b0-4d51-974e-2166a051a89f","title":"CVE-2026-114510: Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across…","summary":"Flexible GraphRAG versions 0.6.0 through 0.8.2 contain a Cypher injection flaw (CVE-2026-114510) in the _escape() helper of flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py. Escaping quotes before backslashes lets an inserted escape be doubled and a quote end the string early. With GRAPH_BACKEND=langchain and GRAPH_DB=falkordb, attacker-influenced document content can make the extraction model emit malicious entity or relationship values that reach these queries, enabling modification or deletion of graph data and, where results are surfaced to users or an LLM, disclosure of graph data.","solution":"Fixed in version 0.8.2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114510","publishedAt":"2026-10-22T15:17:05.500Z","cveId":"CVE-2026-114510","cweIds":["CWE-116","CWE-943"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Flexible GraphRAG","FalkorDB","LangChain","LlamaIndex"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flexible GraphRAG Cypher injection in FalkorDB adapter via ingested documents","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-22T18:10:07.621Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-22T18:10:10.575Z","patchAvailable":null,"disclosureDate":"2026-10-22T15:17:05.500Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}