https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:31:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32247 <p><strong>Affected:</strong> getzep graphiti</p> <p>Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2.</p> <p><strong>Affected:</strong> getzep graphiti</p> <p>Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-32247 https://vulnerability.circl.lu/vuln/ghsa-gg5m-55jj-8m5g <p><strong>Affected:</strong> PyPI: graphiti-core</p> <p>### Summary</p> <p>Graphiti versions before `0.28.2` contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through `SearchFilters.node_labels` were concatenated directly into Cypher label expressions without validation.</p> <p>In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call `search_nodes` with attacker-controlled `entity_types` values. The MCP server mapped `entity_types` to `SearchFilters.node_labels`, which then reached the vulnerable Cypher construction path.</p> <p>Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels.</p> <p>This issue was mitigated in `0.28.2`.</p> <p>### Affected Versions</p> <p>- `0.28.1` and earlier</p> <p>### Fixed Version</p> <p>- `0.28.2`</p> <p>### Affected Components</p> <p>- Graphiti Core search filter construction - Graphiti MCP Server `search_nodes` when used by an LLM client processing untrusted prompts</p> <p>### Technical Details</p> <p>Before `0.28.2`, Graphiti joined `SearchFilters.node_labels` with `|` and inserted the result directly into Cypher label expressions in the shared search-filter constructors used by non-Kuzu providers.</p> <p>The vulnerable logic was effectively:</p> <p>- `node_labels = &#39;|&#39;.join(filters.node_labels)` - `node_lab…</p> <p><strong>Affected:</strong> PyPI: graphiti-core</p> <p>### Summary</p> <p>Graphiti versions before `0.28.2` contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through `SearchFilters.node_labels` were concatenated directly into Cypher label expressions without validation.</p> <p>In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call `search_nodes` with attacker-controlled `entity_types` values. The MCP server mapped `entity_types` to `SearchFilters.node_labels`, which then reached the vulnerable Cypher construction path.</p> <p>Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels.</p> <p>This issue was mitigated in `0.28.2`.</p> <p>### Affected Versions</p> <p>- `0.28.1` and earlier</p> <p>### Fixed Version</p> <p>- `0.28.2`</p> <p>### Affected Components</p> <p>- Graphiti Core search filter construction - Graphiti MCP Server `search_nodes` when used by an LLM client processing untrusted prompts</p> <p>### Technical Details</p> <p>Before `0.28.2`, Graphiti joined `SearchFilters.node_labels` with `|` and inserted the result directly into Cypher label expressions in the shared search-filter constructors used by non-Kuzu providers.</p> <p>The vulnerable logic was effectively:</p> <p>- `node_labels = &#39;|&#39;.join(filters.node_labels)` - `node_lab…</p> https://vulnerability.circl.lu/vuln/ghsa-gg5m-55jj-8m5g