CVE-2025-67644: LangGraph Checkpoint SQLite SQLi Flaw

CVE-2025-67644 Overview

CVE-2025-67644 is a SQL injection vulnerability in langgraph-checkpoint-sqlite, an implementation of LangGraph CheckpointSaver that uses SQLite via both synchronous and asynchronous (aiosqlite) drivers. Versions 3.0.0 and below construct SQL queries by interpolating metadata filter keys directly into f-strings inside the _metadata_predicate() function. Applications that accept untrusted metadata filter keys in checkpoint search operations expose their SQLite backend to query manipulation. The issue is classified under CWE-89 and is fixed in version 3.0.1.

Critical Impact
A local, authenticated attacker who can supply metadata filter keys to checkpoint search operations can inject arbitrary SQL, resulting in confidentiality, integrity, and availability loss on the SQLite checkpoint database.

Affected Products

langchain:langgraph-checkpoint-sqlite versions <= 3.0.0
LangGraph Python applications using the SQLite checkpoint saver (sync)
LangGraph Python applications using the async SQLite checkpoint saver via aiosqlite

Discovery Timeline

2025-12-11 - CVE-2025-67644 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67644

Vulnerability Analysis

The vulnerability resides in the _metadata_predicate() function inside the SQLite checkpoint implementation. The function builds the WHERE clause of checkpoint search queries by interpolating caller-supplied metadata filter keys into Python f-strings. Filter values are passed as bound parameters, but keys are not. An attacker who controls the keys of the metadata filter dictionary in a checkpoint search call can therefore break out of the intended identifier context and append arbitrary SQL. Because LangGraph checkpoints often persist agent state, prompts, tool outputs, and intermediate reasoning, a successful injection can read or modify sensitive agent memory and disrupt downstream graph execution.

Root Cause

The root cause is unsafe string interpolation of user-controlled identifiers into SQL text without validation or allow-listing. The patched code additionally converts the LIMIT clause to a bound parameter (LIMIT ?) rather than inlining the value, closing a related injection surface in the same query builder.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker must be able to influence the keys of the metadata filter dictionary passed to the checkpoint list/search API. In multi-tenant agent platforms that forward request payloads into checkpoint queries, this condition is often met by any authenticated caller.

python

# Patch from libs/checkpoint-sqlite/langgraph/checkpoint/sqlite/__init__.py
         FROM checkpoints
         {where}
         ORDER BY checkpoint_id DESC"""
-        if limit:
-            query += f" LIMIT {limit}"
+        if limit is not None:
+            query += " LIMIT ?"
+            param_values = (*param_values, limit)
         with self.cursor(transaction=False) as cur, closing(self.conn.cursor()) as wcur:
             cur.execute(query, param_values)

Source: langchain-ai/langgraph commit 2972429. The equivalent change is applied to aio.py for the async path.

Detection Methods for CVE-2025-67644

Indicators of Compromise

Checkpoint search calls where metadata filter dictionaries contain keys with SQL metacharacters such as single quotes, --, ;, UNION, or parentheses.
SQLite error entries in application logs referencing malformed identifiers originating from _metadata_predicate().
Unexpected reads or modifications of the checkpoints table outside normal LangGraph write patterns.

Detection Strategies

Perform a dependency inventory to identify Python environments installing langgraph-checkpoint-sqlite at version <= 3.0.0.
Instrument the LangGraph checkpoint layer to log the full key set of every metadata filter and alert on non-alphanumeric keys.
Enable SQLite tracing during development and staging to capture the final SQL text emitted by checkpoint search operations.

Monitoring Recommendations

Forward application and SQLite driver logs to a centralized data lake and correlate checkpoint query anomalies with authenticated session identifiers.
Alert on process behavior where the LangGraph host reads or writes SQLite files outside its expected checkpoint directory.
Track outbound data volume from hosts running LangGraph agents to detect bulk exfiltration of checkpoint contents.

How to Mitigate CVE-2025-67644

Immediate Actions Required

Upgrade langgraph-checkpoint-sqlite to version 3.0.1 or later in all environments.
Audit application code paths that forward untrusted input into the metadata argument of checkpoint list or search calls.
Rotate any secrets that may have been stored in agent state or checkpoint metadata on affected hosts.

Patch Information

The fix is delivered in commit 2972429 and documented in GitHub Security Advisory GHSA-9rwj-6rc7-p77c. The patch parameterizes the LIMIT clause and hardens metadata key handling in both the synchronous and aiosqlite implementations. Upgrade to langgraph-checkpoint-sqlite==3.0.1.

Workarounds

Reject or allow-list metadata filter keys at the application boundary so only known identifiers reach the checkpoint layer.
Restrict filesystem permissions on the SQLite checkpoint database to the minimum service account required.
Isolate LangGraph agent processes so that a compromised checkpoint store cannot be reused across tenants.

bash

# Pin the fixed version in requirements or pyproject
pip install --upgrade 'langgraph-checkpoint-sqlite>=3.0.1'
pip show langgraph-checkpoint-sqlite | grep -i version