High severity · published Oct 29, 2025
CVE-2025-64104
LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. This vulnerability is fixed in 2.0.11.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langgraph · langchain-ai
< 2.0.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64104
github.com
https://github.com/langchain-ai/langgraph/commit/bc9d45b476101e441cb1cc602dea03eb29232de4
github.com
https://github.com/langchain-ai/langgraph/security/advisories/GHSA-7p73-8jqx-23r8
More from langgraph
7.8
CVE-2025-67644
LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method
7.6
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
7.4
CVE-2025-64439
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
7.2
CVE-2026-28277
LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
6.8
CVE-2026-48775
LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading