9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55615

CVE-2026-55615: Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt injection (direct user input or indirect content the agent reads back via RAG), so an attacker who can influence the prompt can read or destroy all graph data and, when APOC or dbms.security procedures are enabled on the server, achieve OS-command and filesystem access. This is the same defect class and threat model as the SQLChatAgent prompt-to-SQL-to-RCE issue fixed in version 0.63.0 (CVE-2026-25879); that fix did not extend to the neo4j module. Version 0.65.5 contains a fix for the neo4j module.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55615

CVE-2026-55615:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langroid	pip	<= 0.65.4	0.65.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Neo4jChatAgent and ArangoChatAgent because they execute LLM-generated database queries (Cypher and AQL, respectively) without proper validation. An attacker can influence the LLM's output via prompt injection, causing it to generate malicious queries. These queries are then passed directly to the database driver.

The core of the issue lies in the tool-handling methods (cypher_retrieval_tool, cypher_creation_tool for Neo4j, and aql_retrieval_tool, aql_creation_tool for ArangoDB). In vulnerable versions, these methods take the query string from the LLM's tool message and execute it via helper methods (read_query, write_query) without any safety checks.

This allows an attacker to perform unauthorized actions:

Data Exfiltration: By injecting queries into the retrieval tools (cypher_retrieval_tool, aql_retrieval_tool), an attacker can read any data from the database.
Data Destruction/Modification: By injecting queries into the creation tools (cypher_creation_tool, aql_creation_tool), an attacker can modify or delete data.
Remote Code Execution (RCE): If the database is configured with powerful procedures (like APOC in Neo4j or user-defined functions in ArangoDB), an attacker can execute commands on the underlying operating system.

The patch, identified in commit 5a3097d9dd6378b08ced5480b0caf76cc58d00fa, introduces a validation mechanism similar to what was previously implemented for SQLChatAgent. It adds a new configuration flag, allow_dangerous_operations (defaulting to False), and new validator functions (validate_cypher_query, validate_aql_query). These validators are now called within the tool-handling methods to inspect the query and reject it if it contains dangerous or unauthorized operations, unless explicitly allowed by the operator. The functions read_query and write_query are the sinks where the unvalidated queries were executed.

Vulnerable functions

Neo4jChatAgent.cypher_retrieval_tool

langroid/agent/special/neo4j/neo4j_chat_agent.py

This function receives a `CypherRetrievalTool` message containing a `cypher_query` from the LLM, which is influenced by user input. In vulnerable versions, this query was executed without validation, allowing for prompt injection to read arbitrary data from the Neo4j database.

Neo4jChatAgent.cypher_creation_tool

langroid/agent/special/neo4j/neo4j_chat_agent.py

This function receives a `CypherCreationTool` message containing a `cypher_query` from the LLM, which is influenced by user input. In vulnerable versions, this query was executed without validation, allowing for prompt injection to write, modify, or delete data in the Neo4j database, and potentially achieve remote code execution if certain procedures are enabled.

Neo4jChatAgent.read_query

langroid/agent/special/neo4j/neo4j_chat_agent.py

This function acts as a sink that executes the Cypher query for the read path. It directly receives the unvalidated, user-influenced query from `cypher_retrieval_tool` and executes it, leading to the vulnerability.

Neo4jChatAgent.write_query

langroid/agent/special/neo4j/neo4j_chat_agent.py

This function acts as a sink that executes the Cypher query for the write path. It directly receives the unvalidated, user-influenced query from `cypher_creation_tool` and executes it, leading to the vulnerability.

ArangoChatAgent.aql_retrieval_tool

langroid/agent/special/arangodb/arangodb_agent.py

This function, similar to its Neo4j counterpart, receives an AQL query from the LLM. In vulnerable versions, it executed this query without validation, allowing for prompt injection to read arbitrary data from the ArangoDB database.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.