CVE-2026-55615: Langroid: unvalidated LLM Cypher enables graph RCE

Langroid's Neo4jChatAgent hands whatever Cypher the LLM generates straight to the Neo4j driver, with no statement-type allowlist, no dangerous-pattern check, and no opt-out gate — the exact defect class already fixed for the sibling SQLChatAgent in CVE-2026-25879, just never ported to the graph module. Because the query text is shaped by prompt injection, either typed directly by a user or smuggled in through content the agent retrieves via RAG, anyone who can influence the conversation controls what runs against your graph database: full read of all data, full destructive write (MATCH (n) DETACH DELETE n is not blocked), and an SSRF primitive via LOAD CSV, with no extra configuration required. Where APOC or dbms.security procedures are enabled on the Neo4j role — a common production setup — this escalates to filesystem access and OS-command execution, the Cypher equivalent of the parent CVE's RCE primitive; there is no CISA KEV listing, EPSS score, or public exploit yet, so this reads as unexploited-in-the-wild but structurally identical to a bug class attackers have already weaponized once in this same project. Any team running Neo4jChatAgent should upgrade to langroid 0.65.5 immediately, set allow_dangerous_operations=False (the new default) and run the agent against a least-privilege Neo4j role rather than one with APOC/admin grants, and audit logs for DETACH DELETE, LOAD CSV, or apoc./dbms. calls issued by the agent's service account as a detection signal for prior exploitation.

Proof-of-concept exploit code is publicly available for CVE-2026-55615, increasing the risk of exploitation.

Upgrade langroid to 0.65.5 or later, which adds the allow_dangerous_operations config gate (default False), restricts CypherRetrievalTool to read-only queries, and rejects LOAD CSV / apoc.* / dbms.* / CALL db.* calls unless explicitly opted in — mirroring the SQLChatAgent fix. Until upgraded, do not deploy Neo4jChatAgent against any Neo4j instance where the connecting role has APOC or dbms.security grants; run it against a least-privilege, read-mostly role and disable APOC entirely on that database if it isn't otherwise required. As a stopgap, front the agent's Cypher execution with an application-level allowlist (SELECT/MATCH-only for retrieval, explicit clause blocklist for CREATE/MERGE paths) until the patched version is rolled out. For detection, alert on any Cypher issued by the agent's service account containing LOAD CSV, apoc., dbms., CALL db., DETACH DELETE, or DROP, and review Neo4j audit logs for unexpected schema or data deletions correlating with agent activity.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, graph databases, knowledge-graph-backed chat assistants.

No CVSS score has been assigned yet.