CVE-2025-8709High· 7.3▾ TwilightA SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path i…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
0.2% → 0.2%
A SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path is directly concatenated into SQL statements without sanitization or parameterization. This allows an attacker who can control filter keys to inject arbitrary SQL expressions, bypass access controls, and retrieve sensitive data such as passwords or API keys from the database.
langchain: SQL Injection in langchain-ai/langchain — rated Important by Red Hat. Released 2025-10-26, updated 2026-10-15.
Not affected:
Refer to the advisory for fix availability.
Affected packages:
langgraph-checkpoint-sqlite < 2.0.11Patched in:
langgraph-checkpoint-sqlite 2.0.11Connected by shared product, vendor, weakness, or advisory.
CVE-2025-64104High· 7.3LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite)
CVE-2025-67644High· 7.3LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)