CVE-2025-8709 Overview
CVE-2025-8709 is a SQL injection vulnerability [CWE-89] in the langchain-ai/langchain repository, specifically within the LangGraph SQLite store implementation. The affected component is langgraph-checkpoint-sqlite version 2.0.10. The flaw stems from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where user-controlled values are concatenated directly into SQL statements without parameterization. Attackers with local, low-privilege access can inject arbitrary SQL to read all stored documents, exfiltrate sensitive fields such as passwords and API keys, and bypass application-level access filters.
Critical Impact
Attackers can bypass LangGraph store access controls and exfiltrate sensitive data including credentials and API keys from the SQLite backend.
Affected Products
- langchain-ai/langchain repository components using LangGraph SQLite store
- langgraph-checkpoint-sqlite 2.0.10
- Applications embedding LangGraph SQLite persistence for agent memory or checkpoints
Discovery Timeline
- 2025-10-26 - CVE-2025-8709 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8709
Vulnerability Analysis
LangGraph provides a SQLite-backed store for persisting agent state, memory, and checkpoints. The store supports MongoDB-style filter operators ($eq, $ne, $gt, $lt, $gte, $lte) so callers can query records by field comparisons. In version 2.0.10, the filter translation layer concatenates operator values into raw SQL strings instead of binding them as parameters. Any caller that can influence filter values can therefore terminate the intended clause and append attacker-controlled SQL. The attack requires local access with low privileges, but the vulnerability crosses a scope boundary because injected SQL runs against the store with the application's own database privileges.
Root Cause
The root cause is a classic failure to use parameterized queries. The filter builder accepts user-supplied comparison values and interpolates them directly into the WHERE clause of the generated SQL. Because SQLite executes the resulting statement as-is, any single quote, semicolon, or UNION fragment inside a filter value is interpreted as SQL syntax rather than data.
Attack Vector
An attacker supplies a crafted filter value through any code path that reaches the vulnerable store method. Typical vectors include agent tools, chat inputs, or API endpoints that forward user-provided metadata into a LangGraph store query. Successful injection returns rows the caller was never authorized to read, enabling exfiltration of secrets stored as checkpoint state and bypass of tenant or namespace filters enforced only at the application layer.
No verified public exploit code has been released. Technical details are available in the Huntr bounty listing.
Detection Methods for CVE-2025-8709
Indicators of Compromise
- SQLite query logs containing operator metacharacters such as ', --, ;, or UNION SELECT inside filter values passed to LangGraph store APIs.
- Unexpected reads spanning multiple namespaces or tenants within a single request handled by the LangGraph store.
- Application logs showing filter payloads referencing columns or tables not present in the caller's normal query surface.
Detection Strategies
- Enable SQLite statement logging in non-production environments and grep for concatenated operator patterns emitted by the store layer.
- Add input validation middleware that rejects filter values containing SQL control characters before they reach LangGraph.
- Review dependency manifests for langgraph-checkpoint-sqlite==2.0.10 across repositories and build artifacts.
Monitoring Recommendations
- Track outbound data volumes from services embedding LangGraph, and alert on anomalous row counts returned from store queries.
- Monitor process telemetry for the Python interpreter accessing SQLite database files outside of expected paths.
- Correlate authentication events with store query patterns to identify low-privilege accounts triggering broad reads.
How to Mitigate CVE-2025-8709
Immediate Actions Required
- Inventory all services using langgraph-checkpoint-sqlite and identify instances pinned to 2.0.10.
- Restrict local access to hosts running LangGraph SQLite stores and rotate any secrets that were stored as checkpoint state.
- Add server-side validation that rejects filter values containing SQL syntax characters until a patched release is deployed.
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Consult the Huntr bounty listing and the langchain-ai/langgraph release notes for the current patched version of langgraph-checkpoint-sqlite, and upgrade beyond 2.0.10 once available.
Workarounds
- Replace the SQLite store with an alternative LangGraph store backend that uses parameterized queries where feasible.
- Wrap filter inputs in a strict allow-list validator that permits only expected field names and primitive value types.
- Run the LangGraph process under a dedicated OS account with read-only access to unrelated data and no ability to write outside the store database file.
# Example: enforce a safe dependency floor once a fixed release is published
pip install --upgrade 'langgraph-checkpoint-sqlite>2.0.10'
pip show langgraph-checkpoint-sqlite | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
