{"id":"CVE-2025-8709","title":"langchain: SQL Injection in langchain-ai/langchain (CVE-2025-8709)","summary":"A SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path i…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvssSource":"vendor","cwe":"CWE-89","vendor":"Red Hat","product":"langgraph-checkpoint-sqlite","affected":["langgraph-checkpoint-sqlite < 2.0.11"],"patched":["langgraph-checkpoint-sqlite 2.0.11"],"published":"2025-10-26","updated":"2026-10-15","sourceUpdated":"2026-10-15T10:42:28+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8709.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8709.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-8709"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406382"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8709"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8709"},{"url":"https://huntr.com/bounties/9793f4b3-76f8-44a4-989f-49a2177ee118"},{"url":"https://github.com/langchain-ai/langgraph/pull/5666"},{"url":"https://github.com/langchain-ai/langgraph/commit/bc9d45b476101e441cb1cc602dea03eb29232de4"},{"url":"https://github.com/langchain-ai/langgraph"},{"url":"https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D2.0.11"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.0022,"epssPercentile":0.12485,"aliases":["GHSA-4h97-wpxp-3757","PYSEC-2026-1528"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:45.491Z","slug":"CVE-2025-8709","body":"## Overview\n\nA SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path is directly concatenated into SQL statements without sanitization or parameterization. This allows an attacker who can control filter keys to inject arbitrary SQL expressions, bypass access controls, and retrieve sensitive data such as passwords or API keys from the database.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8709.json)\n\n**langchain: SQL Injection in langchain-ai/langchain** — rated Important by Red Hat. Released 2025-10-26, updated 2026-10-15.\n\nNot affected:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI)\n\n## Remediation\n\nRefer to the advisory for fix availability.\n\n## Package advisory (CVE-2025-8709)\n\nAffected packages:\n\n- `langgraph-checkpoint-sqlite < 2.0.11`\n\nPatched in:\n\n- `langgraph-checkpoint-sqlite 2.0.11`\n\nSource: https://osv.dev/vulnerability/GHSA-4h97-wpxp-3757","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}