LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

SummaryLangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. Details/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.pyTh...

Malicious code in @sqlite-list/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db66a72ece64d62fe02a712d609f136a1d5bae710c8a97b82dde8e7c39ad9bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@sqlite-list/sql-creator (1.0.7) potentially affected by unknown CVE via @sqlite-list/schema-generator (1.0.2)

@sqlite-list/schema-generator NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @sqlite-list/schema-generator and may be impacted: - @sqlite-list/sql-creator 1.0.7 Source cves: unknown CVE Source advisory:...

Malicious Package

Overview @sqlite-list/schema-generator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-6916 Malicious code in @sqlite-list/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db66a72ece64d62fe02a712d609f136a1d5bae710c8a97b82dde8e7c39ad9bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@sqlite-list/sql-creator (1.0.7) potentially affected by unknown CVE via @sqlite-list/schema-generator (1.0.2)

@sqlite-list/schema-generator NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @sqlite-list/schema-generator and may be impacted: - @sqlite-list/sql-creator 1.0.7 Source cves: unknown CVE Source advisory: GHSA-2859-847V-C4V9...

MAL-2026-6914 Malicious code in @sqlite-access/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5454044dfacdd12da8025ba7a7c73260f16c64b29dbd25ebda52af4d03e8450c The package presents a three-way identity mismatch: the scoped name @sqlite-access/nodesql implies a SQL-access library, the README markets a...

MAL-2026-6917 Malicious code in @sqlite-list/sql-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df9b7b4865e558e78c513925af57c239035b06c15e4ba58f0daf96533d3a336d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @sqlite-list/sql-creator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sqlite-list/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 955f0446501d4d7834ea1d6f4daf244eed7c040462485ba6dc794488f455ea9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sqlite-access/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5454044dfacdd12da8025ba7a7c73260f16c64b29dbd25ebda52af4d03e8450c The package presents a three-way identity mismatch: the scoped name @sqlite-access/nodesql implies a SQL-access library, the README markets a...

Malicious code in @sqlite-list/sql-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df9b7b4865e558e78c513925af57c239035b06c15e4ba58f0daf96533d3a336d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2026-1585 Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows an...

Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows an...

PYSEC-2026-1938 Heap-based Buffer Overflow in sqlite-vec

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npytokennext function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

Heap-based Buffer Overflow in sqlite-vec

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npytokennext function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

datasette-sqlite-vec (>=0.1.1a2, <=0.1.3a3), sqlite-utils-sqlite-vec (>=0.1.1a2, <=0.1.3a3) +1 more potentially affected by CVE-2024-46488 via sqlite-vec (>=0.1.1a2, <=0.1.3a3)

sqlite-vec PYPI version =0.1.1a2, =0.1.1a2, =0.1.1a2, =0.1.3a3 - zf-memician 0.1.3 Source cves: CVE-2024-46488 Source advisory: OSV:PYSEC-2026-1938...

dbt (0.18.2), dbt-bigquery (0.18.2) +9 more potentially affected by CVE-2024-36105 via dbt-core (0.18.2)

dbt-core PYPI version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.2 - dbt-bigquery 0.18.2 - dbt-clickhouse =0.18.2, =0.18.0rc1, =0.0.1, =0.18.1, =0.18.2 Source cves: CVE-2024-36105 Source advisory:...

Apache Superset Improper Input Validation vulnerability

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names likesqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using...

PYSEC-2026-1177 Apache Superset Improper Input Validation vulnerability

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...