PT-2025-45786

Summary Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer used as the default serialization protocol for all checkpointing contains a remote code execution RCE vulnerability when deserializing payloads saved in the "json" serialization mode. If an attacker can cause your...

CVE-2025-64104

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104 Source advisory: OSV:GHSA-7P73-8JQX-23R8...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104 Source advisory: GHSA-7P73-8JQX-23R8...

freiburg-ris-ca (0.1.0), my-agent (0.1.0) potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (1.0.4)

langgraph-checkpoint-sqlite PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2025-64104 Source advisory: OSV:GHSA-7P73-8JQX-23R...

federate (>=0.9.9, <=0.9.10), freiburg-ris-ca (0.1.0) +7 more potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (>=1.0.4, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =1.0.4, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104 Source advisory: MEND:CVE-2025-64104...

langchainlanggraph-checkpoint-sqlite SQL injection vulnerability

langchainlanggraph-checkpoint-sqlite is an open source database connectivity Python library from LangChain. An SQL injection vulnerability exists in langchainlanggraph-checkpoint-sqlite versions prior to 2.0.11, which stems from the use of a direct string concatenation that is not properly...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-64104 +1 more via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104, CVE-2025-8709 Source advisory: SNYK:PYTHON-LANGGRAPHCHECKPOINTSQLITE-13720747...

freiburg-ris-ca (0.1.0), my-agent (0.1.0) potentially affected by CVE-2025-8709 via langgraph-checkpoint-sqlite (1.0.4)

langgraph-checkpoint-sqlite PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2025-8709 Source advisory: OSV:GHSA-4H97-WPXP-3757...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-8709 via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-8709 Source advisory: GHSA-4H97-WPXP-3757...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-8709 via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-8709 Source advisory: OSV:GHSA-4H97-WPXP-3757...

federate (>=0.9.9, <=0.9.10), freiburg-ris-ca (0.1.0) +7 more potentially affected by CVE-2025-8709 via langgraph-checkpoint-sqlite (>=1.0.4, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =1.0.4, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-8709 Source advisory: MEND:CVE-2025-8709...