CVE-2026-55405High· 7.6▾ TwilightLangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.5%
The MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating
filter keys (and, in MariaDB, string values) directly into the query without adequate
escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL
context and inject arbitrary SQL into the statements executed by the stores' search and
removeAll(Filter) operations.
pgvector — JSON mode (default, COMBINED_JSON / COMBINED_JSONB). JSONFilterMapper
places the key inside a single-quoted SQL literal (the JSON key of the ->> operator) with no
escaping:
(metadata->>'<key>')::text
A key containing a single quote breaks out, e.g.
metadataKey("')::text IS NOT NULL OR pg_sleep(1) IS NOT NULL --") injects a live pg_sleep(1)
(observable as a delay; exploitable for blind data extraction).
pgvector — column mode (COLUMN_PER_KEY). ColumnFilterMapper used the key as a bare,
unquoted, unvalidated SQL identifier (<key>::<type>), so a key such as 1=1 OR true --
injects directly.
MariaDB — JSON mode (default). JSONFilterMapper placed the key inside the JSON path literal
'$.<key>' unescaped (same break-out mechanism). Additionally, MariaDbFilterMapper.formatValue()
escaped ' but not \; because MariaDB treats backslash as an escape character by default, a
string value ending in a backslash could also break out of its literal.
MariaDB — column mode (COLUMN_PER_KEY). ColumnFilterMapper fell back to the raw,
unescaped key when the driver could not quote it as an identifier (e.g. a
character).
The filter key is the runtime injection surface; both stores' search() (including pgvector's
HYBRID mode) and removeAll(Filter) are affected. Add/upsert operations a
parameterized and not affected.
Applications that allow attacker-influenced metadata filter keys (e.g. use LLM-generated filters) to reach these stores are exposed to SQL injection: blind data exfiltration, denial of service via sleep functions, and — through `remove deletion of arbitrary rows. Applications using only hard-coded, developer-defined filter keys are not reachable.
Fixed in langchain4j-mariadb and langchain4j-pgvector 1.16.3-beta26:
standard_conforming_strings = on; MariaDB: backslash
and single quote).\ and '.JSONFilterMapper, ColumnFilterMapperJSONFilterMapper, MariaDbFilterMapper, ColumnFilterMapperdev.langchain4j:langchain4j-mariadb <= 1.2.0-beta8dev.langchain4j:langchain4j-mariadb >= 1.3.0-beta9, <= 1.5.0-beta11dev.langchain4j:langchain4j-mariadb >= 1.6.0-beta12, <= 1.11.7-beta19dev.langchain4j:langchain4j-mariadb >= 1.12.1-beta21, <= 1.16.2-beta26dev.langchain4j:langchain4j-pgvector <= 1.2.0-beta8dev.langchain4j:langchain4j-pgvector >= 1.3.0-beta9, <= 1.5.0-beta11dev.langchain4j:langchain4j-pgvector >= 1.6.0-beta12, <= 1.11.7-beta19dev.langchain4j:langchain4j-pgvector >= 1.12.1-beta21, <= 1.16.2-beta26Upgrade to a patched release:
dev.langchain4j:langchain4j-mariadb 1.2.1-beta8dev.langchain4j:langchain4j-mariadb 1.5.1-beta11dev.langchain4j:langchain4j-mariadb 1.11.8-beta19dev.langchain4j:langchain4j-mariadb 1.16.3-beta26dev.langchain4j:langchain4j-pgvector 1.2.1-beta8dev.langchain4j:langchain4j-pgvector 1.5.1-beta11dev.langchain4j:langchain4j-pgvector 1.11.8-beta19dev.langchain4j:langchain4j-pgvector 1.16.3-beta26Connected by shared product, vendor, weakness, or advisory.
CVE-2025-13811Medium· 6.3A vulnerability was determined in jsnjfz WebStack-Guns 1.0
CVE-2025-13788High· 7.3A vulnerability has been found in Chanjet CRM up to 20251106
CVE-2023-7299Medium· 6.3A vulnerability was found in DataGear up to 4.60
CVE-2025-10592Medium· 6.3A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0
CVE-2023-27203Critical· 9.8Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php.
CVE-2023-27202Critical· 9.8Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php.