{"id":"CVE-2026-55405","aliases":["EUVD-2026-43027","GHSA-2mfg-cc43-9pcj"],"status":"published","title":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","description":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00474,"percentile":0.41285,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-06-17T18:39:56Z","modified":"2026-10-28T11:15:00Z","fixes":[{"ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","fixed_in":["1.2.1-beta8","1.5.1-beta11","1.11.8-beta19","1.16.3-beta26"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","fixed_in":["1.2.1-beta8","1.5.1-beta11","1.11.8-beta19","1.16.3-beta26"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0-beta8"},{"fixed":"1.2.1-beta8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-beta9"},{"last_affected":"1.5.0-beta11"},{"fixed":"1.5.1-beta11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0-beta12"},{"last_affected":"1.11.7-beta19"},{"fixed":"1.11.8-beta19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.1-beta21"},{"last_affected":"1.16.2-beta26"},{"fixed":"1.16.3-beta26"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0-beta8"},{"fixed":"1.2.1-beta8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-beta9"},{"last_affected":"1.5.0-beta11"},{"fixed":"1.5.1-beta11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0-beta12"},{"last_affected":"1.11.7-beta19"},{"fixed":"1.11.8-beta19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.1-beta21"},{"last_affected":"1.16.2-beta26"},{"fixed":"1.16.3-beta26"}]}]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-beta8"}]}],"versions":["0.0.002-test-beta2","0.0.11-test-beta11","0.0.6-test-beta6","0.0.7-test-beta7","0.0.9-test-beta9","1.0.0-beta1","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.1-beta6","1.1.0-beta7","1.2.0-beta8"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-beta9"},{"fixed":"1.5.1-beta11"}]}],"versions":["1.3.0-beta9","1.4.0-beta10","1.5.0-beta11"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0-beta12"},{"fixed":"1.11.8-beta19"}]}],"versions":["1.10.0-beta18","1.11.0-beta19","1.11.4-beta19","1.11.5-beta19","1.11.6-beta19","1.11.7-beta19","1.6.0-beta12","1.7.0-beta13","1.7.1-beta14","1.8.0-beta15","1.9.0-beta16","1.9.1-beta17"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.1-beta21"},{"fixed":"1.16.3-beta26"}]}],"versions":["1.12.1-beta21","1.12.2-beta22","1.13.0-beta23","1.13.1-beta23","1.14.0-beta24","1.14.1-beta24","1.15.0-beta25","1.15.1-beta25","1.16.0-beta26","1.16.1-beta26","1.16.2-beta26"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-beta8"}]}],"versions":["0.0.002-test-beta2","0.0.11-test-beta11","0.0.6-test-beta6","0.0.7-test-beta7","0.0.9-test-beta9","0.24.0","0.25.0","0.26.0","0.26.1","0.27.0","0.27.1","0.28.0","0.29.0","0.29.1","0.30.0","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.36.1","0.36.2","1.0.0-alpha1","1.0.0-beta1","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.1-beta6","1.1.0-beta7","1.2.0-beta8"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-beta9"},{"fixed":"1.5.1-beta11"}]}],"versions":["1.3.0-beta9","1.4.0-beta10","1.5.0-beta11"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0-beta12"},{"fixed":"1.11.8-beta19"}]}],"versions":["1.10.0-beta18","1.11.0-beta19","1.11.4-beta19","1.11.5-beta19","1.11.6-beta19","1.11.7-beta19","1.6.0-beta12","1.7.0-beta13","1.7.1-beta14","1.8.0-beta15","1.9.0-beta16","1.9.1-beta17"]},{"source":"osv","ecosystem":"Maven","package":"dev.langchain4j:langchain4j-pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.1-beta21"},{"fixed":"1.16.3-beta26"}]}],"versions":["1.12.1-beta21","1.12.2-beta22","1.13.0-beta23","1.13.1-beta23","1.14.0-beta24","1.14.1-beta24","1.15.0-beta25","1.15.1-beta25","1.16.0-beta26","1.16.1-beta26","1.16.2-beta26"]}],"products":[{"vendor":"langchain4j","product":"langchain4j"}],"references":[{"url":"https://github.com/langchain4j/langchain4j/security/advisories/GHSA-2mfg-cc43-9pcj","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/langchain4j/langchain4j/commit/1bc1f60aa58ef5c3c1703caf73362482480351cf","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/langchain4j/langchain4j/commit/8805d5d128694302f1b0a2650174186862f669e7","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/langchain4j/langchain4j/commit/ce96291dfb243c7f6753b5d65c7a77914642314f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/langchain4j/langchain4j/commit/f14a10ce77e4ea1b8277f67d6a81f46abd7a5bc2","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/langchain4j/langchain4j/releases/tag/1.16.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-2mfg-cc43-9pcj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55405.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55405","tags":["advisory"]},{"url":"https://github.com/langchain4j/langchain4j","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55405","title":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","description":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","status":"published","published":"2026-07-10T20:33:40.804Z","modified":"2026-07-13T14:07:50.892Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-43027","description":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","status":"published","published":"2026-07-10T20:33:40Z","modified":"2026-07-13T14:07:50Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:01.93893Z"}],"ghsa":[{"id":"GHSA-2mfg-cc43-9pcj","title":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","description":"### Summary\nThe MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating\nfilter **keys** (and, in MariaDB, string **values**) directly into the query without adequate\nescaping. A crafted metadata key in `EmbeddingSearchRequest.filter()` can break out of its SQL\ncontext and inject arbitrary SQL into the statements executed by the stores' search and\n`removeAll(Filter)` operations.\n\n### Details\n**pgvector — JSON mode (default, `COMBINED_JSON` / `COMBINED_JSONB`).** `JSONFilterMapper`\nplaces the key inside a single-quoted SQL literal (the JSON key of the `-\u003e\u003e` operator) with no\nescaping:\n\n    (metadata-\u003e\u003e'\u003ckey\u003e')::text\n\nA key containing a single quote breaks out, e.g.\n`metadataKey(\"')::text IS NOT NULL OR pg_sleep(1) IS NOT NULL --\")` injects a live `pg_sleep(1)`\n(observable as a delay; exploitable for blind data extraction).\n\n**pgvector — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` used the key as a bare,\nunquoted, unvalidated SQL identifier (`\u003ckey\u003e::\u003ctype\u003e`), so a key such as `1=1 OR true --`\ninjects directly.\n\n**MariaDB — JSON mode (default).** `JSONFilterMapper` placed the key inside the JSON path literal\n`'$.\u003ckey\u003e'` unescaped (same break-out mechanism). Additionally, `MariaDbFilterMapper.formatValue()`\nescaped `'` but not `\\`; because MariaDB treats backslash as an escape character by default, a\nstring value ending in a backslash could also break out of its literal.\n\n**MariaDB — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` fell back to the raw,\nunescaped key when the driver could not quote it as an identifier (e.g. a\ncharacter).\n\nThe filter key is the runtime injection surface; both stores' `search()` (including pgvector's\nHYBRID mode) and `removeAll(Filter)` are affected. Add/upsert operations a\nparameterized and not affected.\n\n### Impact\nApplications that allow attacker-influenced metadata filter keys (e.g. use\nLLM-generated filters) to reach these stores are exposed to SQL injection: blind data\nexfiltration, denial of service via sleep functions, and — through `remove\ndeletion of arbitrary rows. Applications using only hard-coded, developer-defined filter keys\nare not reachable.\n\n### Patches\nFixed in `langchain4j-mariadb` and `langchain4j-pgvector` 1.16.3-beta26:\n- JSON filter keys are escaped before being embedded in the SQL string lit\n  quotes doubled, correct for PostgreSQL `standard_conforming_strings = on`; MariaDB: backslash\n  and single quote).\n- MariaDB string values escape both `\\` and `'`.\n- Column-mode keys are validated/quoted as identifiers and rejected when u\n  concatenated as raw SQL.\n\n### Workarounds\n- Do not pass untrusted input as metadata filter keys.\n- Restrict filter keys to a known allow-list at the application layer.\n\n### References\n- pgvector: `JSONFilterMapper`, `ColumnFilterMapper`\n- MariaDB: `JSONFilterMapper`, `MariaDbFilterMapper`, `ColumnFilterMapper`","status":"published","published":"2026-06-17T18:39:56Z","modified":"2026-07-16T18:21:17Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"nvd":[{"id":"CVE-2026-55405","description":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","status":"published","published":"2026-07-10T21:16:55.977Z","modified":"2026-07-13T18:09:30.873Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:28.771746Z"}],"osv":[{"id":"CVE-2026-55405","title":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","description":"LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to  1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.","status":"published","published":"2026-07-10T20:33:40.804Z","modified":"2026-10-28T11:15:00.119032446Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-2mfg-cc43-9pcj","title":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","description":"### Summary\nThe MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating\nfilter **keys** (and, in MariaDB, string **values**) directly into the query without adequate\nescaping. A crafted metadata key in `EmbeddingSearchRequest.filter()` can break out of its SQL\ncontext and inject arbitrary SQL into the statements executed by the stores' search and\n`removeAll(Filter)` operations.\n\n### Details\n**pgvector — JSON mode (default, `COMBINED_JSON` / `COMBINED_JSONB`).** `JSONFilterMapper`\nplaces the key inside a single-quoted SQL literal (the JSON key of the `-\u003e\u003e` operator) with no\nescaping:\n\n    (metadata-\u003e\u003e'\u003ckey\u003e')::text\n\nA key containing a single quote breaks out, e.g.\n`metadataKey(\"')::text IS NOT NULL OR pg_sleep(1) IS NOT NULL --\")` injects a live `pg_sleep(1)`\n(observable as a delay; exploitable for blind data extraction).\n\n**pgvector — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` used the key as a bare,\nunquoted, unvalidated SQL identifier (`\u003ckey\u003e::\u003ctype\u003e`), so a key such as `1=1 OR true --`\ninjects directly.\n\n**MariaDB — JSON mode (default).** `JSONFilterMapper` placed the key inside the JSON path literal\n`'$.\u003ckey\u003e'` unescaped (same break-out mechanism). Additionally, `MariaDbFilterMapper.formatValue()`\nescaped `'` but not `\\`; because MariaDB treats backslash as an escape character by default, a\nstring value ending in a backslash could also break out of its literal.\n\n**MariaDB — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` fell back to the raw,\nunescaped key when the driver could not quote it as an identifier (e.g. a\ncharacter).\n\nThe filter key is the runtime injection surface; both stores' `search()` (including pgvector's\nHYBRID mode) and `removeAll(Filter)` are affected. Add/upsert operations a\nparameterized and not affected.\n\n### Impact\nApplications that allow attacker-influenced metadata filter keys (e.g. use\nLLM-generated filters) to reach these stores are exposed to SQL injection: blind data\nexfiltration, denial of service via sleep functions, and — through `remove\ndeletion of arbitrary rows. Applications using only hard-coded, developer-defined filter keys\nare not reachable.\n\n### Patches\nFixed in `langchain4j-mariadb` and `langchain4j-pgvector` 1.16.3-beta26:\n- JSON filter keys are escaped before being embedded in the SQL string lit\n  quotes doubled, correct for PostgreSQL `standard_conforming_strings = on`; MariaDB: backslash\n  and single quote).\n- MariaDB string values escape both `\\` and `'`.\n- Column-mode keys are validated/quoted as identifiers and rejected when u\n  concatenated as raw SQL.\n\n### Workarounds\n- Do not pass untrusted input as metadata filter keys.\n- Restrict filter keys to a known allow-list at the application layer.\n\n### References\n- pgvector: `JSONFilterMapper`, `ColumnFilterMapper`\n- MariaDB: `JSONFilterMapper`, `MariaDbFilterMapper`, `ColumnFilterMapper`","status":"published","published":"2026-06-17T18:39:56Z","modified":"2026-06-17T18:56:26.811474Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}