CVE-2025-67644
📋 TL;DR
CVE-2025-67644 is an SQL injection vulnerability in LangGraph SQLite Checkpoint that allows attackers to manipulate SQL queries through metadata filter keys. Applications using vulnerable versions that accept untrusted metadata filter keys in checkpoint search operations are affected. The vulnerability stems from improper input validation in the _metadata_predicate() function.
💻 Affected Systems
- LangGraph SQLite Checkpoint
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data theft, modification, or deletion; potential remote code execution depending on SQLite configuration and database permissions.
Likely Case
Unauthorized data access, data manipulation, or denial of service through malicious SQL queries.
If Mitigated
Limited impact if applications validate/sanitize metadata filter keys before passing to checkpoint operations.
🎯 Exploit Status
Exploitation requires the ability to control metadata filter keys in checkpoint operations. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.1
Vendor Advisory: https://github.com/langchain-ai/langgraph/security/advisories/GHSA-9rwj-6rc7-p77c
Restart Required: No
Instructions:
1. Update LangGraph SQLite Checkpoint to version 3.0.1 or higher. 2. Run: pip install --upgrade langgraph-sqlite-checkpoint>=3.0.1 3. No restart required, but ensure applications reload the updated package.
🔧 Temporary Workarounds
Input Validation/Sanitization
allImplement strict validation of metadata filter keys before passing to checkpoint operations. Only allow alphanumeric characters and underscores.
Disable Metadata Filtering
allIf metadata filtering is not required, disable or avoid using metadata filter keys in checkpoint operations.
🧯 If You Can't Patch
- Implement strict input validation for all metadata filter keys - only allow known safe values.
- Use parameterized queries or ORM layers instead of direct SQL construction for checkpoint operations.
🔍 How to Verify
Check if Vulnerable:
Check if using LangGraph SQLite Checkpoint version 3.0.0 or below and if application code passes user-controlled data to metadata filter keys in checkpoint operations.Check Version:
pip show langgraph-sqlite-checkpoint | grep VersionVerify Fix Applied:
Verify LangGraph SQLite Checkpoint version is 3.0.1 or higher and review code to ensure metadata filter keys are properly validated.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in SQLite logs
- Unexpected database errors from checkpoint operations
- Suspicious metadata filter patterns
Network Indicators:
- N/A - local SQLite database vulnerability
SIEM Query:
Search for SQL error messages containing 'sqlite3' or 'checkpoint' in application logs, particularly with unusual metadata key patterns.