Executive brief
Langroid, a framework for building AI-powered applications, contains a vulnerability in its Neo4j and ArangoDB agents. These components allow an AI to generate and execute database queries without proper safety checks. An attacker can use 'prompt injection' to trick the AI into executing malicious commands that can read, modify, or delete all data in the database, and in some configurations, gain full control over the underlying server.
Technical details
The Neo4jChatAgent and ArangoChatAgent components in Langroid pass LLM-generated Cypher and AQL queries directly to their respective database drivers without validation, statement-type allowlists, or opt-out gates. Because the query text is influenceable via prompt injection (either through direct user input or indirect RAG content), an attacker can execute arbitrary database commands. This allows for unauthorized data retrieval and destruction. Furthermore, if the database environment has extended procedures enabled (such as Neo4j's APOC/dbms.security or ArangoDB's UDFs/Foxx), an attacker can achieve filesystem access and remote code execution (RCE). This issue is an incomplete fix of the class of vulnerability addressed in CVE-2026-25879. The vulnerability is resolved in version 0.65.5 by introducing a validation layer and an 'allow_dangerous_operations' configuration gate.
Affected products
- langroid langroid < 0.65.5
Timeline
- 2026-06-14: patched: Fix committed to repository
- 2026-06-15: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD