SQL Injection Vulnerability in LangChain4j MariaDB and pgvector Embedding Stores
CVE-2026-55405
What is CVE-2026-55405?
LingChain4j, a Java library designed for developing LLM-powered applications on the JVM, has a SQL injection vulnerability present in its MariaDB and pgvector embedding stores prior to specified versions. This issue arises from inadequate escaping of filter key values when constructing SQL queries, allowing attackers to inject arbitrary SQL commands through crafted metadata keys within the EmbeddingSearchRequest.filter() function. Such malicious inputs can lead to data exfiltration, potential denial of service due to sleep function execution, and the capability to delete arbitrary rows through the removeAll(Filter) operations. Users must upgrade to the patched versions of langchain4j-mariadb and langchain4j-pgvector to mitigate these risks.
Affected Version(s)
langchain4j < 1.2.1-beta8 < 1.2.1-beta8
langchain4j >= 1.3.0-beta9, < 1.5.1-beta11 < 1.3.0-beta9, 1.5.1-beta11
langchain4j >= 1.6.0-beta12, < 1.11.8-beta19 < 1.6.0-beta12, 1.11.8-beta19