CVE-2025-8709

Executive Summary

CVE-2025-8709 is a critical SQL injection vulnerability in the langchain-ai/langchain repository, specifically within the langgraph-checkpoint-sqlite package version 2.0.10. The flaw exists in the handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used instead of parameterized queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, leading to unauthorized access to all stored documents, exfiltration of sensitive fields (e.g., passwords, API keys), and complete bypass of application-level security filters. The CVSS score is 7.3 (High), and no patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python package langgraph-checkpoint-sqlite (PyPI). Organizations using LangGraph with SQLite as a checkpoint store are at risk. The package is part of the LangChain ecosystem, which is widely used in AI/LLM applications. Supply chain risk is elevated due to the lack of a patch and the potential for widespread exploitation in AI pipelines.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any deployment using the affected package.

Deep Dive & Mechanics

The vulnerability resides in the SQLite store implementation of LangGraph. When processing filter operators, the code constructs SQL queries by concatenating user-supplied filter values directly into the query string. For example, a filter like {"field": {"$eq": "value"}} is transformed into WHERE field = 'value' without proper escaping or parameterization. An attacker can craft a malicious filter value containing SQL metacharacters to break out of the string context and execute arbitrary SQL.

The affected operators include:

• $eq (equals)
• $ne (not equals)
• $gt (greater than)
• $lt (less than)
• $gte (greater than or equal)
• $lte (less than or equal)

By injecting a payload like ' OR 1=1--, an attacker can bypass all filters and retrieve all documents. More sophisticated payloads can extract specific fields or modify data.

Vulnerable vs. Patched Code

Vulnerable Code (langgraph-checkpoint-sqlite 2.0.10):

def _build_filter_query(filters):
    conditions = []
    for field, op_dict in filters.items():
        for op, value in op_dict.items():
            if op == '$eq':
                conditions.append(f"{field} = '{value}'")
            elif op == '$ne':
                conditions.append(f"{field} != '{value}'")
            # ... other operators
    return " WHERE " + " AND ".join(conditions)

Patched Code (hypothetical fix):

def _build_filter_query(filters):
    conditions = []
    params = []
    for field, op_dict in filters.items():
        for op, value in op_dict.items():
            if op == '$eq':
                conditions.append(f"{field} = ?")
                params.append(value)
            elif op == '$ne':
                conditions.append(f"{field} != ?")
                params.append(value)
            # ... other operators
    return " WHERE " + " AND ".join(conditions), params

The patched version uses parameterized queries (? placeholders) to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target using LangGraph with SQLite checkpoint store (version 2.0.10).
2. Send a crafted request to the endpoint that processes filter operators. For example, if the API accepts JSON filters:

   {
     "filter": {
       "username": {"$eq": "' OR '1'='1"}
     }
   }
   

3. The vulnerable code will generate: WHERE username = '' OR '1'='1', returning all records.
4. To exfiltrate specific fields, use UNION-based injection:

   {
     "filter": {
       "username": {"$eq": "' UNION SELECT password FROM users--"}
     }
   }
   

Lab Setup:

• Deploy a test environment with langgraph-checkpoint-sqlite==2.0.10.
• Use a simple Flask app that exposes the filter functionality.
• Monitor SQL queries using SQLite logging.

Blue Team

Detection Steps:

1. Monitor for unusual SQL query patterns in SQLite logs (e.g., OR 1=1, UNION SELECT).
2. Implement input validation to reject filter values containing SQL metacharacters (', ", ;, --).
3. Use a Web Application Firewall (WAF) to block SQL injection patterns.
4. Conduct code review to ensure parameterized queries are used.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing filter JSON with SQL metacharacters (e.g., ' OR 1=1--).
• Logs: SQLite query logs showing unexpected OR, UNION, or SELECT statements.
• File: Unauthorized access to SQLite database files (e.g., checkpoint.db).
• Behavior: Sudden increase in data retrieval from checkpoint store.

Detection Engineering

YARA Rule

rule CVE_2025_8709_SQLi_LangGraph {
    meta:
        description = "Detects SQL injection attempts targeting langgraph-checkpoint-sqlite"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8709"
    strings:
        $s1 = /\\$eq\\s*:\\s*['\"][^'\"]*['\"]/ nocase
        $s2 = /\\$ne\\s*:\\s*['\"][^'\"]*['\"]/ nocase
        $s3 = /\\$gt\\s*:\\s*['\"][^'\"]*['\"]/ nocase
        $s4 = /\\$lt\\s*:\\s*['\"][^'\"]*['\"]/ nocase
        $s5 = /\\$gte\\s*:\\s*['\"][^'\"]*['\"]/ nocase
        $s6 = /\\$lte\\s*:\\s*['\"][^'\"]*['\"]/ nocase
        $sqli = /['\"]\\s*(OR|AND|UNION|SELECT|INSERT|DELETE|UPDATE|DROP|--|#)/ nocase
    condition:
        any of ($s*) and $sqli
}

Sigma Rule

title: SQL Injection Attempt Against LangGraph SQLite Store
id: cve-2025-8709-sqli
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-8709
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.body|contains: 
            - '$eq'
            - '$ne'
            - '$gt'
            - '$lt'
            - '$gte'
            - '$lte'
        http.body|contains|all:
            - "' OR "
            - "' AND "
            - " UNION "
            - " SELECT "
    condition: selection
falsepositives:
    - Legitimate use of filter operators with safe values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8709 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"$eq"; http_client_body; content:"' OR "; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or restrict access to the SQLite checkpoint store if not required.
2. Short-term: Implement input validation to sanitize filter values (reject SQL metacharacters).
3. Long-term: Upgrade to a patched version once available. In the meantime, use parameterized queries in custom code.
4. Compensating Controls: Deploy a WAF with SQL injection rules, monitor logs for suspicious queries, and restrict network access to the application.

Valters IT
Securing AI Pipelines, One CVE at a Time.