CVE-2025-8709

A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

An attacker identifies an application built on LangGraph that exposes a checkpoint retrieval endpoint accepting metadata filter parameters (e.g., GET /api/history?filter[$eq]=value). Instead of a legitimate value, they inject a SQL payload such as ' OR '1'='1' --. The unparameterized string concatenation in the SQLite store executes the query returning all checkpoint records, defeating user-scoped isolation entirely. For targeted credential exfiltration, the attacker chains UNION SELECT statements to extract specific fields — API keys, session tokens, or passwords stored by the agent during prior tool calls — then exfiltrates them out of band. The attacker then uses harvested API keys to pivot into integrated services (LLM providers, databases, SaaS tools) the agent had access to, achieving lateral movement beyond the original LangGraph deployment.