PT-2025-48485

Уязвимость реализации протокола сериализации JsonPlusSerializer паттерна сохранения состояния LangGraph Checkpoint системы управления базами данных SQLite связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить...

CVE-2025-64104

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

freiburg-ris-ca (0.1.0), my-agent (0.1.0) potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (1.0.4)

langgraph-checkpoint-sqlite PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2025-64104 Source advisory: OSV:GHSA-7P73-8JQX-23R...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104 Source advisory: OSV:GHSA-7P73-8JQX-23R8...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104 Source advisory: GHSA-7P73-8JQX-23R8...

GHSA-7P73-8JQX-23R8 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

Summary LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. Details /langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py...

EUVD-2025-36720

LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore...

CVE-2025-64104

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

CVE-2025-64104

LangGraph SQLite Checkpoint (SqliteStore) has a SQL injection vulnerability due to direct string concatenation when building JSON path-based filters. Effective prior to version 2.0.11, this flaw could allow attackers with local privileges to inject arbitrary SQL and bypass access controls. The is...

CVE-2025-64104 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

CVE-2025-64104

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

CVE-2025-64104 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

federate (>=0.9.9, <=0.9.10), freiburg-ris-ca (0.1.0) +7 more potentially affected by CVE-2025-64104 via langgraph-checkpoint-sqlite (>=1.0.4, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =1.0.4, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104 Source advisory: MEND:CVE-2025-64104...

CVE-2025-64104 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

PT-2025-44346

Name of the Vulnerable Software and Affected Versions LangGraph versions prior to 2.0.11 Description The LangGraph SQLite Checkpoint component, used with SQLite databases, contains SQL injection flaws. This is due to direct string concatenation without proper parameterization, which allows...

langchainlanggraph-checkpoint-sqlite SQL injection vulnerability

langchainlanggraph-checkpoint-sqlite is an open source database connectivity Python library from LangChain. An SQL injection vulnerability exists in langchainlanggraph-checkpoint-sqlite versions prior to 2.0.11, which stems from the use of a direct string concatenation that is not properly...

PT-2025-45681

Summary LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. Details /langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py...

CVE-2025-64104: Improper Neutralization of Special Elements used in an SQL Command

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

federate (>=0.9.9, <=0.9.10), haistings (0.0.2) +5 more potentially affected by CVE-2025-64104 +1 more via langgraph-checkpoint-sqlite (>=2.0.0, <=2.0.10)

langgraph-checkpoint-sqlite PYPI version =2.0.0, =0.9.9, =1.0.1, =0.1.0a1, =0.1.0a24 Source cves: CVE-2025-64104, CVE-2025-8709 Source advisory: SNYK:PYTHON-LANGGRAPHCHECKPOINTSQLITE-13720747...

SQL Injection

Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to SQL Injection via improper handling of filter $eq, $ne, $gt, $lt, $gte, $lte operators in the LangGraph SQLite store implementation. An...