Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2025-67644 EUVD-2025-202333GHSA-9rwj-6rc7-p77cPYSEC-2026-1530

LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method

Published Dec 10, 2025 · Updated Dec 11, 2025 · Assigned by GitHub_M

Vendor: langchain-ai Product: langgraph Package: langgraph-checkpoint-sqlite Ecosystem: PyPI

Description

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation. This issue is fixed in version 3.0.1.

Affected products

VendorProductAffectedFixed
langchain-ai langgraph < 3.0.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI langgraph-checkpoint-sqlite < 3.0.1 3.0.1 GHSA-9rwj-6rc7-p77c

References