CVE-2025-8709

描述

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.

如何修補 CVE-2025-8709

要修補 CVE-2025-8709,請將受影響套件升級到下列已修補版本。

• —升級至 2.0.11 或更新版本
• —升級至 2.0.11 或更新版本

CVE-2025-8709 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 2.0.11
• from 0, < 2.0.11

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-4h97-wpxp-3757
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-8709
• PATCHgithub.com/langchain-ai/langgraph
• PATCHpypi.org/project/langgraph-checkpoint-sqlite
• WEB