{"id":"GHSA-2mfg-cc43-9pcj","summary":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","details":"### Summary\nThe MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating\nfilter **keys** (and, in MariaDB, string **values**) directly into the query without adequate\nescaping. A crafted metadata key in `EmbeddingSearchRequest.filter()` can break out of its SQL\ncontext and inject arbitrary SQL into the statements executed by the stores' search and\n`removeAll(Filter)` operations.\n\n### Details\n**pgvector — JSON mode (default, `COMBINED_JSON` / `COMBINED_JSONB`).** `JSONFilterMapper`\nplaces the key inside a single-quoted SQL literal (the JSON key of the `-\u003e\u003e` operator) with no\nescaping:\n\n    (metadata-\u003e\u003e'\u003ckey\u003e')::text\n\nA key containing a single quote breaks out, e.g.\n`metadataKey(\"')::text IS NOT NULL OR pg_sleep(1) IS NOT NULL --\")` injects a live `pg_sleep(1)`\n(observable as a delay; exploitable for blind data extraction).\n\n**pgvector — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` used the key as a bare,\nunquoted, unvalidated SQL identifier (`\u003ckey\u003e::\u003ctype\u003e`), so a key such as `1=1 OR true --`\ninjects directly.\n\n**MariaDB — JSON mode (default).** `JSONFilterMapper` placed the key inside the JSON path literal\n`'$.\u003ckey\u003e'` unescaped (same break-out mechanism). Additionally, `MariaDbFilterMapper.formatValue()`\nescaped `'` but not `\\`; because MariaDB treats backslash as an escape character by default, a\nstring value ending in a backslash could also break out of its literal.\n\n**MariaDB — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` fell back to the raw,\nunescaped key when the driver could not quote it as an identifier (e.g. a\ncharacter).\n\nThe filter key is the runtime injection surface; both stores' `search()` (including pgvector's\nHYBRID mode) and `removeAll(Filter)` are affected. Add/upsert operations a\nparameterized and not affected.\n\n### Impact\nApplications that allow attacker-influenced metadata filter keys (e.g. use\nLLM-generated filters) to reach these stores are exposed to SQL injection: blind data\nexfiltration, denial of service via sleep functions, and — through `remove\ndeletion of arbitrary rows. Applications using only hard-coded, developer-defined filter keys\nare not reachable.\n\n### Patches\nFixed in `langchain4j-mariadb` and `langchain4j-pgvector` 1.16.3-beta26:\n- JSON filter keys are escaped before being embedded in the SQL string lit\n  quotes doubled, correct for PostgreSQL `standard_conforming_strings = on`; MariaDB: backslash\n  and single quote).\n- MariaDB string values escape both `\\` and `'`.\n- Column-mode keys are validated/quoted as identifiers and rejected when u\n  concatenated as raw SQL.\n\n### Workarounds\n- Do not pass untrusted input as metadata filter keys.\n- Restrict filter keys to a known allow-list at the application layer.\n\n### References\n- pgvector: `JSONFilterMapper`, `ColumnFilterMapper`\n- MariaDB: `JSONFilterMapper`, `MariaDbFilterMapper`, `ColumnFilterMapper`","aliases":["CVE-2026-55405"],"modified":"2026-06-17T18:56:26.811474Z","published":"2026-06-17T18:39:56Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-06-17T18:39:56Z","nvd_published_at":null,"cwe_ids":["CWE-89"]},"references":[{"type":"WEB","url":"https://github.com/langchain4j/langchain4j/security/advisories/GHSA-2mfg-cc43-9pcj"},{"type":"PACKAGE","url":"https://github.com/langchain4j/langchain4j"}],"affected":[{"package":{"name":"dev.langchain4j:langchain4j-mariadb","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-mariadb"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-beta8"}]}],"versions":["0.0.002-test-beta2","0.0.11-test-beta11","0.0.6-test-beta6","0.0.7-test-beta7","0.0.9-test-beta9","1.0.0-beta1","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.1-beta6","1.1.0-beta7","1.2.0-beta8"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.2.0-beta8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json"}},{"package":{"name":"dev.langchain4j:langchain4j-mariadb","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-mariadb"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-beta9"},{"fixed":"1.5.1-beta11"}]}],"versions":["1.3.0-beta9","1.4.0-beta10","1.5.0-beta11"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.5.0-beta11","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json"}},{"package":{"name":"dev.langchain4j:langchain4j-mariadb","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-mariadb"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0-beta12"},{"fixed":"1.11.8-beta19"}]}],"versions":["1.10.0-beta18","1.11.0-beta19","1.11.4-beta19","1.11.5-beta19","1.11.6-beta19","1.11.7-beta19","1.6.0-beta12","1.7.0-beta13","1.7.1-beta14","1.8.0-beta15","1.9.0-beta16","1.9.1-beta17"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.11.7-beta19","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json"}},{"package":{"name":"dev.langchain4j:langchain4j-mariadb","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-mariadb"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.1-beta21"},{"fixed":"1.16.3-beta26"}]}],"versions":["1.12.1-beta21","1.12.2-beta22","1.13.0-beta23","1.13.1-beta23","1.14.0-beta24","1.14.1-beta24","1.15.0-beta25","1.15.1-beta25","1.16.0-beta26","1.16.1-beta26","1.16.2-beta26"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json","last_known_affected_version_range":"\u003c= 1.16.2-beta26"}},{"package":{"name":"dev.langchain4j:langchain4j-pgvector","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-pgvector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-beta8"}]}],"versions":["0.0.002-test-beta2","0.0.11-test-beta11","0.0.6-test-beta6","0.0.7-test-beta7","0.0.9-test-beta9","0.24.0","0.25.0","0.26.0","0.26.1","0.27.0","0.27.1","0.28.0","0.29.0","0.29.1","0.30.0","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.36.1","0.36.2","1.0.0-alpha1","1.0.0-beta1","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.1-beta6","1.1.0-beta7","1.2.0-beta8"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.2.0-beta8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json"}},{"package":{"name":"dev.langchain4j:langchain4j-pgvector","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-pgvector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-beta9"},{"fixed":"1.5.1-beta11"}]}],"versions":["1.3.0-beta9","1.4.0-beta10","1.5.0-beta11"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json","last_known_affected_version_range":"\u003c= 1.5.0-beta11"}},{"package":{"name":"dev.langchain4j:langchain4j-pgvector","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-pgvector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0-beta12"},{"fixed":"1.11.8-beta19"}]}],"versions":["1.10.0-beta18","1.11.0-beta19","1.11.4-beta19","1.11.5-beta19","1.11.6-beta19","1.11.7-beta19","1.6.0-beta12","1.7.0-beta13","1.7.1-beta14","1.8.0-beta15","1.9.0-beta16","1.9.1-beta17"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.11.7-beta19","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json"}},{"package":{"name":"dev.langchain4j:langchain4j-pgvector","ecosystem":"Maven","purl":"pkg:maven/dev.langchain4j/langchain4j-pgvector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.1-beta21"},{"fixed":"1.16.3-beta26"}]}],"versions":["1.12.1-beta21","1.12.2-beta22","1.13.0-beta23","1.13.1-beta23","1.14.0-beta24","1.14.1-beta24","1.15.0-beta25","1.15.1-beta25","1.16.0-beta26","1.16.1-beta26","1.16.2-beta26"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.16.2-beta26","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2mfg-cc43-9pcj/GHSA-2mfg-cc43-9pcj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"}]}