Langroid’s Neo4jChatAgent forwards LLM‑generated Cypher queries directly to a Neo4j driver without any validation or statement‑type allowlisting. Because the query text can be influenced by prompt injection, an attacker who can steer the prompt can read, delete, or otherwise manipulate any data stored in the graph. If the Neo4j instance enables APOC or dbms.security procedures, the attacker can elevate that activity to OS‑command and filesystem access. This is an injection flaw (CWE‑74) that compromises confidentiality, integrity, and availability and can lead to full system compromise.

All installations of the Langroid framework with Neo4jChatAgent running the pre‑0.65.5 code, including older releases that have not been updated to 0.65.5, are affected. The vulnerability exists only when the agent is configured to forward Cypher to the server; systems using other Langroid agents or newer versions are immune. The fix was backported into version 0.65.5, which adds validation and an allowlist for Cypher statements.

The flaw carries a CVSS score of 9.2 indicating critical severity. An EPSS score of 0.00461 (<1%) is available, and the vulnerability is not yet listed in CISA’s KEV catalog, but its similarity to the already high‑profile SQLChatAgent RCE (CVE‑2026‑25879) suggests a realistic exploit path. Attacks require a user capable of influencing the model’s prompt, which is feasible through normal application usage or crafted messages to the LLM. Once injection succeeds, the presence of APOC or dbms.security procedures enables escalation to OS commands, making exploitation a high‑threat scenario.