Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditi...

Date Jul 6, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product PyPI · langroid

CVE CVE-2026-55615

Critical vendor advisory CVE-2026-55615

Summary

Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

Why it matters

GitHub has published a reviewed security advisory for langroid. Prioritize it with other application dependency updates.

Operator check

Check whether langroid is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available. CVSS score: 9.2.

Sources

GitHub Advisory GHSA-2pq5-3q89-j7cc NVD — CVE-2026-55615 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed