The report
In a GraphRAG pipeline, ordinary source documents become graph nodes and relations that an assistant later retrieves as evidence. The Flexible GraphRAG advisory describes how text from such an input reached the FalkorDB adapter's Cypher query builder without safe value binding. A crafted field could change the graph command rather than remain an inert property value.
The affected range is Flexible GraphRAG 0.6.0 up to but excluding 0.8.2, according to the reviewed advisory, with version 0.8.2 listed as patched. The attack requires a route for untrusted document content to enter the affected adapter. A proof of graph alteration is not proof of a known customer's knowledge base being wiped, and the model need not issue a malicious instruction for the injection to reach the database.
Why this is an AI-security incident
A retrieval system gives the resulting graph an evidential role in later answers. If the ingestion layer permits a document author to alter that graph's structure, the attacker can affect both current storage and the evidence future agent decisions encounter. The control belongs at the database boundary: literal parameter binding, scoped write permissions and adversarial ingestion tests using an isolated graph. A prompt filter cannot repair an unsafe query constructor. The separate Case records the exact input-to-command boundary.