Broken escape function lets documents wipe GraphRAG databases

A security advisory published on 27 October 2026 describes a query injection flaw in Flexible GraphRAG, an open-source retrieval pipeline that builds knowledge graphs from ingested documents. The bug, tracked as CVE-2026-114510 in advisory GHSA-vqrg-773h-4wxc, affects the project's FalkorDB adapter and can be triggered by the contents of an ingested document. The advisory says the demonstrated impact is the deletion of every node and relationship in the graph in a single call.

The cause is a two-line escaping function that performs its replacements in the wrong order. According to the advisory, the function first inserts a backslash in front of every single quote, then doubles every backslash, including the ones it has just added. For a value ending in a quote, the result is two backslashes followed by an unescaped quote. Under the backslash-escape convention used for single-quoted Cypher string literals, that is read as one escaped backslash and then a quote that closes the string. The quote is never neutralised, and the string breaks open.

The escaped value is then pasted straight into Cypher queries built with Python string formatting rather than query parameters, at five places in the same method, the advisory says. Node labels and relationship types are also interpolated into backtick-quoted identifiers with no escaping at all.

What makes this reachable from the outside is where the data comes from. The entity names and relationships fed into those queries are produced by a large language model reading ingested documents. The advisory describes the result as an indirect prompt injection chained into query injection: an attacker writes a document whose text steers the extraction model into emitting an entity identifier containing a payload, and the broken escape function turns that payload into live Cypher.

The published proof of concept uses an identifier that closes the property map and appends a second clause deleting all nodes, followed by a comment marker that swallows the rest of the original query. The advisory notes that the researcher executed only the escape function and the query template, not the package itself, and did not initially test against a live database. The maintainer later confirmed the issue was exploitable against a running FalkorDB instance, adding that FalkorDB requires a WITH clause between MERGE and MATCH; with that small change, the payload deleted every node in the graph.

The advisory says the same primitive could be adapted to exfiltrate data by returning other nodes' properties through a field the calling code shows to the user or the model, or to tamper with existing records, depending on what the application surfaces.

Only one configuration is affected: the LangChain graph backend combined with FalkorDB. The advisory states that the LlamaIndex FalkorDB store is not affected. A fix shipped in version 0.8.2, which passes values as query parameters and strips backticks from labels, relationship types and property keys. For users who cannot upgrade immediately, the advisory suggests switching to the LlamaIndex backend with FalkorDB, or using a different graph database.