SQL Injection Affecting langchain-cloudflare package, versions [,0.1.11)
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-LANGCHAINCLOUDFLARE-14860937
- published5 Jan 2026
- disclosed1 Jan 2026
- creditUnknown
Introduced: 1 Jan 2026
CVE NOT AVAILABLE CWE-89 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade langchain-cloudflare to version 0.1.11 or higher.
Overview
langchain-cloudflare is a Langchain Integrations for Cloudflare's WorkersAI and Vectorize
Affected versions of this package are vulnerable to SQL Injection due to improper sanitization of nested metadata in D1 database operations. The d1_upsert_texts and ad1_upsert_texts methods construct SQL queries using string formatting without escaping special characters, allowing nested metadata fields containing single quotes to break out of SQL string literals.