Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
影響: pip:flexible-graphrag >= 0.6.0, < 0.8.2 → 0.8.2
def _escape(v: str) -> str: return str(v).replace("'", "\\'").replace("\\", "\\\\") The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an input ending in a single quote, the two steps combined produce \\' (two backslashes followed by the quote) in the output — which, under the standard backslash-escape convention used by Cypher/openCypher…
| CVE | CVE-2026-114510 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 12:32, GitHub Advisory Database에서 "Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-114510.