Cypher/Graph-Query Injection via Unsanitized node_labels or group_ids Field
An AI agent's knowledge-graph or memory tool accepts labels or group identifiers that are supposed to be simple names, but an attacker can smuggle in query syntax instead. This lets them break out of the intended field and run their own database commands.
How the attack works
The agent exposes a tool that takes node_labels or group_ids parameters and uses them to build a Cypher (or Lucene/RedisSearch) query string. Instead of a normal short identifier like 'Person' or 'team-alpha', an attacker supplies a value ending in a closing backtick, parenthesis, or brace followed by a real query clause such as MATCH, MERGE, CREATE, CALL db., or DETACH DELETE. Because the input isn't validated, the escape character closes out the intended fragment and the attacker's clause executes as part of the query. This mirrors classic SQL injection but targets the Cypher query language used by graph-database memory backends.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e8ff8cff-a1e1-4cd8-a4e9-d7340ed872fe
- Severity
- High
- CVEs
- CVE-2026-32247
Why it matters
An attacker can read, modify, or delete data in the agent's knowledge graph or memory store, including deleting nodes and relationships (DETACH DELETE) or calling database procedures (CALL db.), potentially corrupting or exfiltrating stored memory content.
What you can do
- →Validate node_labels and group_ids as strict identifier strings (allow-list characters, no backticks/parentheses/braces) before they reach any query-building code.
- →Use parameterized queries or the driver's built-in escaping for Cypher/Lucene/RedisSearch instead of string interpolation.
- →Apply the same validation on both read and write paths, since label interpolation can be exploited during writes too.
- →Monitor graph-tool calls for parameter values containing escape characters immediately followed by query keywords like MATCH, MERGE, CREATE, CALL db., or DETACH DELETE.
Known benign look-alikes
- Ordinary node_labels or group_ids values that are plain identifier strings (Person, Employee, team-alpha) with no escape characters or query keywords
- A node_labels/group_ids value that happens to contain a parenthesis as part of a legitimate display name, without a following Cypher clause keyword