Evidence · DiggingBeagle record
Flexible GraphRAG FalkorDB Cypher injection advisory
Security advisory for unsafe Cypher string escaping in the FalkorDB graph-writing adapter.
- Source role
- primary disclosure
Evidence record
Security advisory for unsafe Cypher string escaping in the FalkorDB graph-writing adapter.
Claim-level citations (1)
- supportsFlexible GraphRAG document text could alter FalkorDB Cypher commands: GHSA-vqrg-773h-4wxc reports that Flexible GraphRAG before 0.8.2 constructed Cypher queries with defective escaping, allowing attacker-controlled ingested text to change graph commands.
GHSA-vqrg-773h-4wxc, summary, _escape() example and patched version 0.8.2