flexible-graphrag: Cypher injection in FalkorDB adapter
The flexible-graphrag Python package (FalkorDB adapter) is vulnerable to Cypher injection due to a flawed string-escaping implementation and the use of string interpolation for query construction.
CVE search metadata
CVE search record: CVE-2026-114510. Severity: high. CVSS: 7.1. EPSS: 0.24%. KEV: no. Brief: flexible-graphrag: Cypher injection in FalkorDB adapter. Brief link: https://feed.craftedsignal.io/briefs/2026-10-flexible-graphrag-cypher-injection/
Triage facts
Revision 1- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 28, 18:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The _escape() function in the flexible-graphrag FalkorDB adapter contains an ordering error that fails to neutralize single quotes. Because the adapter uses f-string interpolation for Cypher queries, untrusted document content containing malicious payloads can escape string literals and inject arbitrary Cypher clauses. Additionally, node labels and relationship types are interpolated without escaping. Exploitation can result in unauthorized graph data modification or deletion.