2025-10-26

CVE-2025-8709 Oct 26, 06:15 HIGH PATCH This Week

SQL injection in langgraph-checkpoint-sqlite 2.0.10 allows attacker-controlled values passed to the store's filter operators ($eq, $ne, $gt, $lt, $gte, $lte) to be concatenated directly into SQL statements, letting a query escape its intended filter and return every document in the store - including sensitive fields such as passwords and API keys. Exploitation requires a local attack vector with low privileges (CVSS 7.3, AV:L/PR:L/UI:N/S:C), so risk is gated on whether the deploying application exposes filter inputs to untrusted users and whether it is still running the vulnerable 2.0.10 release. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, context-dependent risk rather than an emergency.