{"id":69,"date":"2026-10-29T06:38:52","date_gmt":"2026-10-29T06:38:52","guid":{"rendered":"https:\/\/bugskan.com\/?p=69"},"modified":"2026-10-29T06:38:53","modified_gmt":"2026-10-29T06:38:53","slug":"historical-advisory-prompt-injection-could-manipulate-langchain-graph-queries","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/historical-advisory-prompt-injection-could-manipulate-langchain-graph-queries\/","title":{"rendered":"Historical advisory: prompt injection could manipulate LangChain graph queries"},"content":{"rendered":"<p>OSV\u2019s CVE-2024-8309 record describes prompt injection in GraphCypherQAChain that could lead to unauthorized graph-data access or modification. Its listed consequences include data extraction, destructive queries, and disruption.<\/p>\n<p>The record covers langchain and langchain-community with separate affected ranges. Do not apply one package\u2019s version number to the other; consult the current package tables for the installation being assessed.<\/p>\n<p>The design lesson is that a generated query inherits the permissions of its execution account. For an older deployment, update affected dependencies and review whether the connection can perform operations beyond the application\u2019s intended use. That review should include tenant boundaries where several customers share infrastructure.<\/p>\n<p><a href=\"https:\/\/osv.dev\/vulnerability\/GHSA-45pg-36p6-83v9\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>GraphCypherQAChain connects model output to database operations; permissions matter alongside dependency updates.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_b4ef78020a2a26","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"LangChain GraphCypherQAChain","bugskan_recommended_next_step":"Compare both installed packages with the advisory and restrict database privileges.","bugskan_who_should_check":"Teams running GraphCypherQAChain against sensitive or shared graph databases.","bugskan_material_updated_at":"2026-07-07T17:57:12Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[20],"class_list":["post-69","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-langchain"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/69","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=69"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/69\/revisions"}],"predecessor-version":[{"id":306,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/69\/revisions\/306"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=69"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=69"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=69"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=69"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=69"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}