Description
A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.
INFO
Published Date :
2025-10-26T05:38:55.335Z
Last Modified :
2025-10-28T14:32:39.540Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2025-8709 vulnerability.
| Vendors | Products |
|---|---|
| Langchain |
|
| Langchain-ai |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-8709.
