A retrieval pipeline ingests documents to construct knowledge graph entities and relations. A malformed input field then passes through the FalkorDB adapter and into generated Cypher syntax. Under the demonstrated payload, the query can alter or delete graph state, which can contaminate later agent retrieval. The issue is a database command boundary, not…
Inspect the ClaimsCase · DiggingBeagle record
Flexible GraphRAG document text could alter FalkorDB Cypher commands
GHSA-vqrg-773h-4wxc reports that Flexible GraphRAG before 0.8.2 constructed Cypher queries with defective escaping, allowing attacker-controlled ingested text to change graph commands.
Scope
Requires ingestion of attacker-controlled content into the affected FalkorDB adapter; real customer graph deletion is not established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The advisory describes lower-trust document content being incorporated into FalkorDB Cypher statements. The consequence depends on the graph database permission context and construction path; confirmed production exfiltration is not supplied. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-FLEXGRAPHRAG-CYPHER-1 · Flexible GraphRAG FalkorDB Cypher injection advisory
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsRequires ingestion of attacker-controlled content into the affected FalkorDB adapter; real customer graph deletion is not established.
Limits and uncertaintyFull account
A retrieval pipeline ingests documents to construct knowledge graph entities and relations. A malformed input field then passes through the FalkorDB adapter and into generated Cypher syntax. Under the demonstrated payload, the query can alter or delete graph state, which can contaminate later agent retrieval. The issue is a database command boundary, not proof that the model itself planned the malicious action.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-FLEXGRAPHRAG-CYPHER-1GHSA-vqrg-773h-4wxc reports that Flexible GraphRAG before 0.8.2 constructed Cypher queries with defective escaping, allowing attacker-controlled ingested text to change graph commands.supported
Basis: reported finding
- supportsFlexible GraphRAG FalkorDB Cypher injection advisoryprimary disclosure
GHSA-vqrg-773h-4wxc, summary, _escape() example and patched version 0.8.2
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Upgrade to 0.8.2, use parameterized graph queries, and test ingestion with escaped and control-character fields against a disposable graph.
Unknowns and contradictions
- Requires ingestion of attacker-controlled content into the affected FalkorDB adapter; real customer graph deletion is not established.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211