High severity · published Dec 10, 2025
CVE-2025-67644
LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method
7.8
CVSS
2.3%
EPSS
No
On KEV
Description
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation. This issue is fixed in version 3.0.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langgraph · langchain-ai
< 3.0.1 · source: vendor
LA
Langgraph-checkpoint-sqlite · Langchain
before 3.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67644
Patch
https://github.com/langchain-ai/langgraph/commit/297242913f8ad2143ee3e2f72e67db0911d48e2a
Exploit
https://github.com/langchain-ai/langgraph/security/advisories/GHSA-9rwj-6rc7-p77c
More from langgraph
7.6
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
7.4
CVE-2025-64439
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
7.3
CVE-2025-64104
LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore
7.2
CVE-2026-28277
LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
6.8
CVE-2026-48775
LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading