LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

🗓️ 17 Jun 2026 18:39:56Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 3 Views

SQL injection via metadata filter keys in langchain4j MariaDB and pgvector stores from unsafe key/value concatenation.

Reporter	Title	Published	Views	Family All 3
CVE	CVE-2026-55405	17 Jun 202618:39	–	cve
OSV	GHSA-2MFG-CC43-9PCJ LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector	17 Jun 202618:39	–	osv
Positive Technologies	PT-2026-50596	17 Jun 202600:00	–	ptsecurity

Vulners

Node

dev.langchain4j langchain4j-pgvectorRange1.12.1-beta21–1.16.2-beta26maven

OR

dev.langchain4j langchain4j-pgvectorRange1.6.0-beta12–1.11.7-beta19maven

OR

dev.langchain4j langchain4j-pgvectorRange1.3.0-beta9–1.5.0-beta11maven

OR

dev.langchain4j langchain4j-pgvectorRange≤1.2.0-beta8maven

OR

dev.langchain4j langchain4j-mariadbRange1.12.1-beta21–1.16.2-beta26maven

OR

dev.langchain4j langchain4j-mariadbRange1.6.0-beta12–1.11.7-beta19maven

OR

dev.langchain4j langchain4j-mariadbRange1.3.0-beta9–1.5.0-beta11maven

OR

dev.langchain4j langchain4j-mariadbRange≤1.2.0-beta8maven

Source	Link
github	www.github.com/langchain4j/langchain4j/security/advisories/GHSA-2mfg-cc43-9pcj
github	www.github.com/advisories/GHSA-2mfg-cc43-9pcj

17 Jun 2026 18:39Current

5.8Medium risk

Vulners AI Score5.8

langchain4j metadata filter keys sql injection mariadb pgvector json mode column mode unescaped keys embedding search removeAll filter