CVE-2025-67644 LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method
Attackers can execute arbitrary SQL commands via metadata filter keys in LangGraph SQLite Checkpoint, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67644?
CVE-2025-67644 is a high-severity SQL injection vulnerability in langchain-ai langgraph, published on 10 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation. This issue is fixed in version 3.0.1.
Weakness: CWE-89
Which versions are affected by CVE-2025-67644?
3 open source packages ship an affected version, including langgraph-checkpoint-sqlite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langgraph-checkpoint-sqlite PyPI | All versions | 3.0.1 |
langgraph-checkpoint-sqlite PyPI | All versions | 3.0.1 |
langgraph-checkpoint-sqlite PyPI | All versions | 3.0.1 |
Products include Langchain Langgraph-Checkpoint-Sqlite.
How do I fix CVE-2025-67644?
Upgrade langgraph-checkpoint-sqlite to 3.0.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-67644 being exploited?
There is no known exploitation of CVE-2025-67644 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-9rwj-6rc7-p77c, PYSEC-2026-1530.