Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-jza8-b2m9-2ycr

Summary LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. This vulnerability is fixed in 2.0.11.

Aliases

alias	CVE-2025-64104

alias	GHSA-7p73-8jqx-23r8

Fixed_packages

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.11

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.11

Affected_packages

url pkg:pypi/langgraph-checkpoint-sqlite@1.0.0

purl pkg:pypi/langgraph-checkpoint-sqlite@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@1.0.0

url pkg:pypi/langgraph-checkpoint-sqlite@1.0.1

purl pkg:pypi/langgraph-checkpoint-sqlite@1.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@1.0.1

url pkg:pypi/langgraph-checkpoint-sqlite@1.0.2

purl pkg:pypi/langgraph-checkpoint-sqlite@1.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@1.0.2

url pkg:pypi/langgraph-checkpoint-sqlite@1.0.3

purl pkg:pypi/langgraph-checkpoint-sqlite@1.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@1.0.3

url pkg:pypi/langgraph-checkpoint-sqlite@1.0.4

purl pkg:pypi/langgraph-checkpoint-sqlite@1.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@1.0.4

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.0

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.0

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.1

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.1

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.2

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.2

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.3

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.3

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.4

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.4

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.5

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.5

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.6

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.6

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.7

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.7

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.8

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.8

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.9

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.9

url pkg:pypi/langgraph-checkpoint-sqlite@2.0.10

purl pkg:pypi/langgraph-checkpoint-sqlite@2.0.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1vr9-u3zr-17dz

vulnerability	VCID-jza8-b2m9-2ycr

vulnerability	VCID-reve-vr7e-7ufb

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/langgraph-checkpoint-sqlite@2.0.10

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2025-64104

reference_id

reference_type

scores

value	0.00039
scoring_system	epss
scoring_elements	0.12101
published_at	2026-06-12T12:55:00Z

value	0.00039
scoring_system	epss
scoring_elements	0.12009
published_at	2026-06-11T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2025-64104

reference_url

https://github.com/langchain-ai/langgraph

reference_id

reference_type

scores

value	7.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/langchain-ai/langgraph

reference_url

https://github.com/langchain-ai/langgraph/commit/bc9d45b476101e441cb1cc602dea03eb29232de4

reference_id

bc9d45b476101e441cb1cc602dea03eb29232de4

reference_type

scores

value	7.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T15:33:02Z/

url

https://github.com/langchain-ai/langgraph/commit/bc9d45b476101e441cb1cc602dea03eb29232de4

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2025-64104

reference_id

CVE-2025-64104

reference_type

scores

value	7.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2025-64104

reference_url

https://github.com/advisories/GHSA-7p73-8jqx-23r8

reference_id

GHSA-7p73-8jqx-23r8

reference_type

scores

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-7p73-8jqx-23r8

reference_url

https://github.com/langchain-ai/langgraph/security/advisories/GHSA-7p73-8jqx-23r8

reference_id

GHSA-7p73-8jqx-23r8

reference_type

scores

value	7.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T15:33:02Z/

url

https://github.com/langchain-ai/langgraph/security/advisories/GHSA-7p73-8jqx-23r8

Weaknesses

cwe_id	89
name	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 7.0 - 8.9

Exploitability 0.5

Weighted_severity 8.0

Risk_score 4.0

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jza8-b2m9-2ycr

Vulnerability Instance