Detections
Analytics

SCA: security update for flexible-graphrag (GHSA-vqrg-773h-4wxc)

high Tenable Self-Hosted Container Security Plugin ID 477614

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications
 across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in
 flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes
 and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an
 inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and
 GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction
 model to produce malicious entity or relationship values that reach these queries, allowing injected
 Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the
 user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into
 backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not
 affected. This issue is fixed in version 0.8.2. (CVE-2026-114510)

Solution

Update the flexible-graphrag library and its related packages to version 0.8.2 or later.

See Also

https://github.com/advisories/GHSA-vqrg-773h-4wxc

Plugin Details

Severity: High

ID: 477614

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-114510

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-114510