Langroid Neo4jChatAgent Prompt-to-Cypher Injection Leading to RCE

Technical Analysis

The entry point is any text that reaches the LLM's context window feeding Neo4jChatAgent, including untrusted RAG-retrieved documents or direct user input. Because the agent treats LLM output as trusted and passes it verbatim to the Neo4j driver's query execution API, there is no boundary between natural-language reasoning and privileged database operations, allowing prompt injection to translate directly into arbitrary Cypher execution. This crosses the trust boundary between the LLM (untrusted reasoning layer) and the database tool (privileged execution layer), a classic tool-layer injection pattern. When APOC procedures or dbms.security extensions are enabled, Cypher's procedure-call capability extends the blast radius from data manipulation to OS command execution and filesystem access, achieving full RCE. The same defect class was already fixed for the SQL-backed agent in v0.63.0, indicating a systemic pattern-matching failure to propagate the sanitization fix across all database-connector modules.

Affected Systems

Langroid

Detection Signatures

• Log entries showing Cypher queries containing CALL apoc.* or CALL dbms.* procedures originating from LLM-generated tool calls
• Unexpected DELETE, DETACH DELETE, or DROP statements in Neo4jChatAgent query logs
• Cypher queries containing shell-like strings, file paths, or encoded payloads embedded in RAG-sourced text
• Anomalous query patterns immediately following ingestion of external/untrusted documents
• Tool invocation logs where LLM output is passed directly to driver.execute_query without an intermediate validation step

Remediation Steps

1. 1

   Upgrade Langroid

   Update to Langroid version 0.65.5 or later, which contains the fix for the neo4j module.

2. 2

   Implement Cypher statement allowlisting

   Restrict Neo4jChatAgent to a predefined set of read-only or parameterized query templates rather than allowing arbitrary LLM-generated Cypher.

3. 3

   Disable dangerous procedures

   Disable or restrict APOC and dbms.security procedures on the Neo4j server unless explicitly required, and apply least-privilege database roles to the agent's connection.

4. 4

   Sanitize and validate LLM output before execution

   Add a validation layer that parses generated Cypher for disallowed statement types (DELETE, CALL, DROP, procedure invocations) before execution.

5. 5

   Isolate RAG content from executable context

   Treat retrieved/indirect content as untrusted data and avoid allowing it to directly influence query-generation prompts without sanitization or provenance tagging.