SQL Injection Vulnerability in LangGraph SQLite Checkpoint Implementation
CVE-2025-64104

7.3HIGH

Key Information:

Vendor

Langchain-ai

Status
Langgraph
Vendor
CVE Published:
29 October 2025

What is CVE-2025-64104?

LangGraph SQLite Checkpoint contains vulnerabilities due to its use of direct string concatenation in SQL queries without proper parameterization. This oversight allows attackers to perform SQL injection attacks, potentially manipulating the database and bypassing access controls. Users are advised to upgrade to version 2.0.11 or later to mitigate these risks.

Affected Version(s)

langgraph < 2.0.11

References

https://github.com/langchain-ai/langgraph/security/adviso...
x_refsource_CONFIRM
https://github.com/langchain-ai/langgraph/commit/bc9d45b4...
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64104 : SQL Injection Vulnerability in LangGraph SQLite Checkpoint Implementation