CVE-2026-55405: LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

June 17, 2026 (updated July 16, 2026)

The MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys (and, in MariaDB, string values) directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores’ search and removeAll(Filter) operations.

References

github.com/advisories/GHSA-2mfg-cc43-9pcj
github.com/langchain4j/langchain4j/security/advisories/GHSA-2mfg-cc43-9pcj
nvd.nist.gov/vuln/detail/CVE-2026-55405

Code Behaviors & Features

Detect and mitigate CVE-2026-55405 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →