Input Validation Vulnerability in Flexible GraphRAG Framework by Steve Reiner

CVE-2026-114510

What is CVE-2026-114510?

The Flexible GraphRAG framework, specifically versions 0.6.0 to 0.8.2, contains an input validation vulnerability due to improper handling of quotes in the _escape() function. This permits attackers to craft meticulously altered document content that influences the extraction model, potentially allowing malicious Cypher clauses to execute, which can modify or delete essential graph data. Additionally, when unsafe parameters are utilized in query results, sensitive graph data may inadvertently be disclosed. This vulnerability is resolved in version 0.8.2, which implements improved validation mechanisms.

References