LangGraph SQLite Checkpoint CVE-2025-64104
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess application using vulnerable SqliteStore
-
DeliverySubmit crafted untrusted filter key
-
ExploitBreak out of json_extract concatenation
-
ExecutionBypass access-control filter conditions
-
ImpactRead unauthorized stored records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable ONLY when an application both (1) instantiates SqliteStore from the langgraph-checkpoint-sqlite package AND (2) constructs the filter argument using keys derived from untrusted/user-supplied input (query params, request bodies, external data). The injection is specifically in the JSON-path KEY portion concatenated into json_extract(value, '$.<key>') in _prepare_batch_search_queries, _get_batch_list_namespaces_queries, and _get_batch_GET_ops_queries; the VALUE portion is already single-quote-escaped and is not the injection point. Limiting factors: if filter keys are static or validated/allowlisted before reaching the store, the risk does not apply; versions <= 2.0.10 are affected (fixed in 2.0.11); and users of LangSmith/LangGraph Platform deployments are NOT affected because they use a different checkpointer implementation. |
| Impact | Signals point to a real-but-conditional, moderate-priority issue rather than a mass-exploitation emergency. The CVSS 3.1 base score of 7.3 (HIGH) is driven by C:H and a changed scope (S:C) reflecting access-control bypass, but the vector itself tempers urgency: AV:L (local/in-process vulnerable component), AC:L, PR:L, UI:N. EPSS is very low at 0.19% (8th percentile), there is NO CISA KEV listing (not confirmed actively exploited), and the exploitation is gated by a specific application coding pattern. Working exploit code is public (publicly available exploit code exists) - a complete POC ships in GHSA-7p73-8jqx-23r8 and a regression test in the patch commit - but POC availability is not active exploitation; the low EPSS plus absence of KEV suggests no observed widespread exploitation. Key conflict to verify: the CVSS uses AV:L (the SqliteStore operates in-process over a local SQLite file), yet the realistic threat model in the advisory is a remote user supplying malicious filter keys through an application - so effective reachability may be network-delivered even though the vulnerable component is local; defenders should assess their own app's exposure rather than rely on AV:L alone. |
| Exploit ScenarioDerived | An application using LangGraph's SqliteStore builds the search/list filter from user-supplied input (e.g., query parameters or request bodies). An attacker submits a crafted filter key such as "access') = 'public' OR '1'='1' OR json_extract(value, '$." that breaks out of the json_extract() expression, bypassing the intended access-control filter and returning private records (including secrets/passwords stored in the value). A complete, working POC is published in the GHSA advisory and as a regression test in the patch commit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
SQL injection in the langgraph-checkpoint-sqlite store (versions up to and including 2.0.10) lets an attacker who can influence the filter keys passed to SqliteStore.search() and related methods inject arbitrary SQL into json_extract() JSON-path expressions, bypassing access controls and reading records that should be restricted - for example retrieving 'private' documents alongside 'public' ones. Publicly available exploit code exists in the form of a full proof-of-concept published with the GitHub advisory GHSA-7p73-8jqx-23r8, though EPSS is low (0.19%, 8th percentile) and there is no CISA KEV entry indicating active exploitation. The assessed vector is local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 7.3) and, critically, reachability is conditional: an application is only exposed if it instantiates SqliteStore from the checkpoint-sqlite package AND builds the filter argument from untrusted or user-supplied keys; LangSmith/LangGraph Platform deployments are not affected because they use a different checkpointer implementation.
RemediationAI
Vendor-released patch: upgrade langgraph-checkpoint-sqlite to 2.0.11 or later (pip install -U langgraph-checkpoint-sqlite); this is the release that introduces the _validate_filter_key() regex guard (^[a-zA-Z0-9_.-]+$) in _prepare_batch_search_queries, _get_batch_list_namespaces_queries and _get_batch_GET_ops_queries, and the fix is documented in advisory GHSA-7p73-8jqx-23r8 and commit bc9d45b476101e441cb1cc602dea03eb29232de4. If upgrading immediately is not possible, the effective compensating control is to stop treating filter keys as untrusted data: allowlist or strictly validate every key supplied to SqliteStore.search(), list_namespaces() and get() against a fixed set of expected JSON property names (alphanumeric, underscore, dot and hyphen only) and reject anything else before it reaches the store. Applications that only ever pass static, hard-coded filter keys are already outside the risk envelope and need no change; applications that build filters from query parameters, request bodies or other external data must sanitize at the boundary. Note the side effect of allowlisting is reduced flexibility for dynamic filtering, so keep the accepted key set as a versioned configuration rather than hard-coding it in application logic. There is no indication that disabling SQLite's JSON1 extension is practical, since json_extract is central to how the store queries metadata; if it can be disabled, the store will fail rather than execute the injected path, but that is a disruptive and untested workaround.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (SQL injection) caused by direct string concatenation of the JSON-path key segment in SQLite queries that use the JSON1 extension. In libs/checkpoint-sqlite/langgraph/store/sqlite/base.py, filter conditions are assembled as "json_extract(value, '$." + key + "') = '" + value.replace("'", "''") + "'". Only the value side is single-quote escaped; the key is inserted verbatim into the JSON path, so a crafted key such as "access') = 'public' OR '1'='1' OR json_extract(value, '$." terminates the json_extract string literal and rewrites the WHERE clause. The same concatenation pattern appears in three code paths - _prepare_batch_search_queries, _get_batch_list_namespaces_queries, and _get_batch_GET_ops_queries - covering both the synchronous and aiosqlite-backed asynchronous implementations, meaning search, namespace listing and put/get operations are all in scope for the injected predicate. The upstream fix (commit bc9d45b476101e441cb1cc602dea03eb29232de4) adds a _validate_filter_key() helper that rejects any key not matching the regular expression ^[a-zA-Z0-9_.-]+, raising ValueError on invalid filter keys before the query is built, and includes a regression test (test_sql_injection_vulnerability) that confirms the previously exploitable key now throws 'Invalid filter key'. The affected component is the pip package langgraph-checkpoint-sqlite, identified as vulnerable through 2.0.10 and fixed in 2.0.11.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Vulnerable component is an in-process SQLite store (AV:L), reachable only when the app forwards untrusted filter keys (PR:L); access-control bypass crosses an authorization boundary (S:C) exposing stored data (C:H), with limited integrity (I:L) and no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. This vulnerability is fixed in 2.0.11.
Blast Radius
ecosystem impact- 16 pypi packages depend on langgraph-checkpoint-sqlite (16 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.11.
Executive ViewAI
Applications that use langgraph-checkpoint-sqlite up to and including version 2.0.10 may allow an authenticated local user to bypass access controls and read restricted records when filter keys are built from untrusted or user-supplied input. Publicly available exploit code exists, but there is no CISA KEV entry. Because exposure is conditional on application design and no vendor-released patch identified at time of analysis, leadership should prioritize inventorying affected deployments and limiting risk where user-controlled keys reach SqliteStore search methods.
Interim mitigations include strict allowlisting and validation of filter keys before they reach json_extract(), rejecting user-supplied keys from JSON-path expressions, restricting local authenticated access, applying least privilege to the SQLite database and host, monitoring for anomalous or excessive read activity, and isolating affected applications until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB