Junglewise Threat Intelligence

CVE-2025-8709: PYSEC-2026-1528 - LangGraph's SQLite store implementation has a SQL Injection Vulnerability

CVE-2025-8709 · Severity: low · CVSS 3 · Published 2026-07-07

Technologies: langgraph-checkpoint-sqlite (PyPI). Vendors: PyPI.

Executive brief

LangGraph's SQLite store implementation has a SQL Injection Vulnerability

Affected products

PyPI langgraph-checkpoint-sqlite

Related threats

LangGraph incorrect authorization in Postgres and SQLite namespace matching
PYSEC-2026-1530 - LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method
PYSEC-2026-1529 - LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore