SQL Injection Affecting langgraph-checkpoint-sqlite package, versions [,3.0.1)
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-LANGGRAPHCHECKPOINTSQLITE-14287461
- published10 Dec 2025
- disclosed10 Dec 2025
- creditVladimirEliTokarev, yardenporat353
Introduced: 10 Dec 2025
New CVE NOT AVAILABLE CWE-89 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade langgraph-checkpoint-sqlite to version 3.0.1 or higher.
Overview
langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver.
Affected versions of this package are vulnerable to SQL Injection due to untrusted metadata filter keys being directly used in SQL queries without proper validation. An attacker can access or manipulate unauthorized data by supplying crafted filter keys that alter the intended SQL logic.