{"id":"ghsa-ghsa-vqrg-773h-4wxc","seq":1708799,"kind":"advisory","title":"Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content","url":"https://github.com/advisories/GHSA-vqrg-773h-4wxc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vqrg-773h-4wxc","summary":"影響: pip:flexible-graphrag >= 0.6.0, < 0.8.2 → 0.8.2\ndef _escape(v: str) -> str: return str(v).replace(\"'\", \"\\\\'\").replace(\"\\\\\", \"\\\\\\\\\") The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an input ending in a single quote, the two steps combined produce \\\\' (two backslashes followed by the quote) in the output — which, under the standard backslash-escape convention used by Cypher/openCypher…","severity":"high","techs":["python"],"cves":["CVE-2026-114510"],"tags":["GHSA-vqrg-773h-4wxc","flexible-graphrag"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:32:45.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}