Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, listnamespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace. Details BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out: - get(("tenant.bob",), key), search(("tenant.bob",)) and listnamespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob"). - delete(("tenant.alice",), key) deleted the item stored under…
Recommended action: Upgrade to 3.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling namespaces whose flattened form shares leading characters. Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient. We have no evidence of this behavior being exploited in the wild. Affected users / systems You may be affected if you: - use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and - rely on the namespace to separate data between users or tenants, and - have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing or % Applications whose namespace labels…
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Context A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation that allows attackers to manipulate SQL queries through metadata filter keys. This affects applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. Impact Attackers who control metadata filter keys can execute arbitrary sql queries against the database. Root Cause The metadatapredicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation: While filter values are parameterized, filter keys are not validated, allowing SQL injection. Attack Example Before Fix: Resulting SQL: Who Is Affected? LangSmith Deployment Customers: NOT Impacted LangSmith deployment customers are NOT affected by this vulnerability. LangSmith deployments do not allow configuring custom checkpointers, so the vulnerable code path cannot be reached. High Risk: Custom Server Deployments You are affected if your…
Recommended action: Upgrade to 3.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. Details `/langgraph/libs/checkpoint-sqlite/langgraph/store/sqlite/base.py` The key portion of the JSON path is concatenated directly into the SQL string without sanitation. There's a few different occurrences within the file. ```python filter_conditions.append( "json_extract(value, '$." + key <-- Directly concatenated, no escaping! + "') = '" + value.replace("'", "''") <-- Only value is escaped + "'" ) ``` Who is affected This issue affects only developers or projects that directly use the `checkpoint-sqlite` store. An application is vulnerable only if it: 1. Instantiates the `SqliteStore` from…
Recommended action: Upgrade to 2.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.
Recommended action: Upgrade to 2.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.