CVE-2025-64104 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore
Attackers can inject arbitrary SQL via filter keys in LangGraph's SQLite store, bypassing access controls and modifying or reading data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64104?
CVE-2025-64104 is a high-severity SQL injection vulnerability in langchain-ai langgraph, published on 29 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. This vulnerability is fixed in 2.0.11.
Weakness: CWE-89
Which versions are affected by CVE-2025-64104?
3 open source packages ship an affected version, including langgraph-checkpoint-sqlite.
| Package | Affected | Fixed in |
|---|---|---|
langgraph-checkpoint-sqlite PyPI | All versions | 2.0.11 |
langgraph-checkpoint-sqlite PyPI | All versions | 2.0.11 |
langgraph-checkpoint-sqlite PyPI | All versions | 2.0.11 |
How do I fix CVE-2025-64104?
Upgrade langgraph-checkpoint-sqlite to 2.0.11 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-64104 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64104 exists.
Sources
Also known as GHSA-7p73-8jqx-23r8, PYSEC-2026-1529.