{
 "id": "AIR-2026-1158",
 "slug": "sql-injection-in-langchain4j-embedding-stores",
 "title": "SQL Injection in LangChain4j Embedding Stores",
 "summary": "LangChain4j MariaDB and pgvector embedding stores build metadata filter SQL using string concatenation without adequate escaping. Crafted metadata keys allow attackers to inject arbitrary SQL statements, enabling data exfiltration and denial of service.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "LangChain4j"
 ],
 "incident_date": "2026-07-10",
 "incident_date_precision": "day",
 "first_reported": "2026-07-10",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55405",
   "publisher": "NVD",
   "title": "CVE-2026-55405: LangChain4j is a Java library for building LLM-powered applications on the JVM.",
   "published_at": "2026-07-10"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-55405",
  "sql-injection"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}