AIKIDO-2026-917028

TL;DR

CSVGraphAgent.pandas_to_kg executes fully LLM-generated Cypher through write_query without the validate_cypher_query and allow_dangerous_operations gating applied to the agent's other Cypher handlers. Input that influences the prompt, including CSV contents embedded verbatim into the system message, can drive arbitrary Cypher under the agent's Neo4j role. This allows full graph read and exfiltration, destructive writes, LOAD CSV from a remote URL, and configuration-conditional code execution where APOC or dbms procedures are enabled. The fix routes this handler through the same validation gate as the other Cypher tools.