Loading story…
Langroid fixed CVE-2026-55615 in Neo4jChatAgent, where LLM-generated Cypher queries were sent to Neo4j without validation before version 0.65.5. Because the query text could be influenced by direct user prompts or indirectly through retrieved RAG content, an attacker could abuse prompt-to-Cypher injection to read, modify, or destroy graph data. In Neo4j deployments with dangerous procedures enabled, including APOC or dbms.security features, the flaw could also expose the filesystem and enable operating system command execution.
A related Langroid patch also addressed the same defect pattern in ArangoChatAgent, where unvalidated AQL could be passed to the database driver. The remediation introduced a default-off allow_dangerous_operations control and validator functions that enforce read-only behavior on retrieval paths while blocking risky primitives such as Neo4j CALL db.*, LOAD CSV, APOC and dbms procedures, and ArangoDB namespace::func UDF calls unless explicitly enabled by an operator. The fix was described as mirroring the earlier SQLChatAgent bug tracked as CVE-2026-25879, and the project added 76 static unit tests to cover attack vectors, enforcement, bypass attempts, and false-positive handling.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-55615 was disclosed for a vulnerability affecting Langroid versions prior to 0.65.5 in which Neo4jChatAgent executed LLM-generated Cypher without validation, allowing prompt-injection-driven graph data access or destruction and possible OS-level impact when risky Neo4j procedures were enabled. The disclosure states the issue was fixed in version 0.65.5 and notes it mirrors the earlier SQLChatAgent bug tracked as CVE-2026-25879.
On 2026-06-15, a langroid commit addressed a security issue where LLM-generated Cypher and AQL queries were passed directly to database drivers without validation, enabling prompt-injection-driven data access or destruction and possible escalation in certain database configurations. The patch added a default-off allow_dangerous_operations gate, validator functions, and unit tests, and was associated with advisory GHSA-2pq5-3q89-j7cc.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-25879**, a critical vulnerability in the Langroid Python framework that lets attackers use prompt injection to steer the `SQLChatAgent` component into executing malicious LLM-generated SQL. The flaw can bypass intended input restrictions and abuse database-specific primitives, potentially escalating from SQL manipulation to **remote code execution** on the database host. Reported impacts include arbitrary command execution, data exfiltration, destructive database changes, and possible lateral movement, and the issue was rated **CVSS 9.8**. The exposure affects Langroid versions prior to **0.63.0** and is most severe when the application connects with highly privileged database roles, including capabilities such as PostgreSQL `pg_execute_server_program`, MySQL `FILE`, or MSSQL `xp_cmdshell`. Researchers also warned that exploitation may occur through indirect attacker influence over data returned to the LLM, not only through direct user prompts. Langroid patched the issue in version **0.63.0** by enforcing a strict `SELECT`-only allowlist parsed with `sqlglot` and adding a dialect-aware blocklist for dangerous patterns, while still permitting trusted deployments to restore broader behavior with `allow_dangerous_operations=True`.
Jun 29, 2026
Check Point Research disclosed three vulnerabilities in LangGraph’s persistence layer affecting self-hosted deployments that use SQLite or Redis checkpointers and expose `get_state_history()` with a user-controlled filter. The most severe attack chain combines a SQL injection flaw in the SQLite checkpointer, tracked as **CVE-2025-67644**, with unsafe `msgpack` deserialization, tracked as **CVE-2026-28277**, allowing an attacker to insert a malicious checkpoint row that is later deserialized into remote code execution. Researchers also identified a SQL injection issue in the Redis checkpointer, **CVE-2026-27022**, along with additional defense-in-depth SQL injection concerns in SQLite and PostgreSQL query construction. LangChain released patches and urged users to upgrade to **`langgraph-checkpoint-sqlite` 3.0.1 or later**, **`langgraph` 1.0.10 or later**, and **`langgraph-checkpoint-redis` 1.0.2 or later**. The exposed-risk scenario described in the report applies to self-hosted environments with vulnerable checkpointer configurations, while LangSmith Deployment was reported as unaffected by the primary attack path because it uses PostgreSQL rather than the impacted SQLite or Redis setups.
Jun 29, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026