CVE-2025-8709: langgraph-checkpoint-sqlite SQL injection in SQLite store filter operators

Summary

A SQL injection flaw in the LangGraph SQLite store implementation in the langchain-ai/langchain repository affects langgraph-checkpoint-sqlite 2.0.10. Filter operators ($eq, $ne, $gt, $lt, $gte, $lte) are concatenated into SQL strings without parameterization, letting attackers inject arbitrary SQL. Successful exploitation grants unauthorized access to all documents, exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database