SQL Injection Vulnerability in LangGraph's SQLite Store by langchain-ai

CVE-2025-8709

What is CVE-2025-8709?

A SQL injection vulnerability affects the langchain-ai/langchain repository, specifically the SQLite store implementation of LangGraph. In the vulnerable version 2.0.10, improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) exposes the application to attacks. Direct concatenation of strings without parameterization enables malicious actors to inject arbitrary SQL commands, resulting in unauthorized access to documents and sensitive data, including passwords and API keys. This vulnerability allows attackers to bypass application-level security measures, making it critical for users to address and patch their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References