CVE-2026-55615: Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.5%, percentile 39: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 39% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes langroid (PyPI) <= 0.65.4, fixed in 0.65.5. Check your lockfile, including transitive dependencies.

What it is

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt injection (direct user input or indirect content the agent reads back via RAG), so an attacker who can influence the prompt can read or destroy all graph data and, when APOC or dbms.security procedures are enabled on the server, achieve OS-command and filesystem access. This is the same defect class and threat model as the SQLChatAgent prompt-to-SQL-to-RCE issue fixed in version 0.63.0 (CVE-2026-25879); that fix did not extend to the neo4j module. Version 0.65.5 contains a fix for the neo4j module.

From the GitHub advisory

Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt injection (direct user input or indirect content the agent reads back via RAG), so an attacker who can influence the prompt can read or destroy all graph data and, when APOC or dbms.security procedures are enabled on the server, achieve OS-command and filesystem access. This is the same defect class and threat model as the SQLChatAgent prompt-to-SQL-to-RCE issue fixed in version 0.63.0 (CVE-2026-25879); that fix did not extend to the neo4j module.

Technical detail Untrusted-input to sink trace (reviewed on langroid HEAD b9df06f, v0.65.3):

1. Tool schemas accept raw query text from the LLM. langroid/agent/special/neo4j/tools.py:4-9 (CypherRetrievalTool.cypherquery: str) and :15-21 (CypherCreationTool.cypherquery: str). These tools are enabled unconditionally in neo4jchatagent.py:412-419 (enablemessage([GraphSchemaTool, CypherRetrievalTool, CypherCreationTool, DoneTool])).

2. Read path. neo4jchatagent.py:300 cypherretrievaltool(msg) -> :325 query = msg.cypherquery -> :328 self.readquery(query) -> :223 session.run(query, parameters). The LLM-controlled string is the first positional argument to session.run; parameters is None. No validation occurs between :325 and :223.

3. Write path. neo4jchatagent.py:338 cyphercreationtool(msg) -> :348 query = msg.cypherquery -> :351 self.writequery(query) -> :276 session.writetransaction(lambda tx: tx.run(query, parameters)). The only inspection of the string (writequery :251-264) is a query.upper() substring test for CREATE/MERGE/CONSTRAINT/INDEX whose sole effect is setting self.config.databasecreated = True; it blocks nothing. A query such as MATCH (n) DETACH DELETE n (the same statement the built-in removedatabase helper runs at :287-293) passes unrestricted.

Weakness type: CWE-74.

Product: langroid (PyPI) · Assigned by: GitHub_M · Published: 2026-07-09

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: present (depends on deployment conditions)
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.46% probability of exploitation activity in the next 30 days; percentile 39.

Timeline

• 2026-07-06 — GitHub-reviewed advisory GHSA-2pq5-3q89-j7cc published (critical)
• 2026-07-09 — CVE record published by GitHub_M
• 2026-07-10 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-2pq5-3q89-j7cc github.com
2. CVE.org record CVE-2026-55615 cve.org
3. NVD entry CVE-2026-55615 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com

Critical PyPI advisories · Today’s Security Digest