---
id: CVE-2025-8709
title: 'langchain: SQL Injection in langchain-ai/langchain (CVE-2025-8709)'
summary: >-
  A SQL injection vulnerability exists in LangGraph’s SQLite store
  implementation due to improper string concatenation when building filter
  conditions in the _get_filter_condition() function. The JSON key portion of
  the json_extract() path i…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: vendor
cwe: CWE-89
vendor: Red Hat
product: langgraph-checkpoint-sqlite
affected:
  - langgraph-checkpoint-sqlite < 2.0.11
patched:
  - langgraph-checkpoint-sqlite 2.0.11
published: '2025-10-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:42:28+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8709.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8709.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-8709'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2406382'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-8709'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8709'
  - url: 'https://huntr.com/bounties/9793f4b3-76f8-44a4-989f-49a2177ee118'
  - url: 'https://github.com/langchain-ai/langgraph/pull/5666'
  - url: >-
      https://github.com/langchain-ai/langgraph/commit/bc9d45b476101e441cb1cc602dea03eb29232de4
  - url: 'https://github.com/langchain-ai/langgraph'
  - url: >-
      https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D2.0.11
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.0022
epssPercentile: 0.12485
aliases:
  - GHSA-4h97-wpxp-3757
  - PYSEC-2026-1528
ecosystem: pip
ingestedAt: '2026-07-08T18:25:45.491Z'
---

## Overview

A SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path is directly concatenated into SQL statements without sanitization or parameterization. This allows an attacker who can control filter keys to inject arbitrary SQL expressions, bypass access controls, and retrieve sensitive data such as passwords or API keys from the database.

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8709.json)

**langchain: SQL Injection in langchain-ai/langchain** — rated Important by Red Hat. Released 2025-10-26, updated 2026-10-15.

Not affected:

- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux AI (RHEL AI)

## Remediation

Refer to the advisory for fix availability.

## Package advisory (CVE-2025-8709)

Affected packages:

- `langgraph-checkpoint-sqlite < 2.0.11`

Patched in:

- `langgraph-checkpoint-sqlite 2.0.11`

Source: https://osv.dev/vulnerability/GHSA-4h97-wpxp-3757