Listen to this Post
This vulnerability exists in the `_metadata_predicate()` function within LangGraph’s SQLite checkpoint saver. When constructing SQL `WHERE` clauses for metadata filtering, the function uses Python f-strings to directly insert user-supplied filter key names into the query string. While the corresponding filter values are safely parameterized, the keys are not validated or sanitized. This allows an attacker who controls the metadata filter key name to inject arbitrary SQL logic. For example, providing a key like `x’) OR ‘1’=’1` breaks out of the `json_extract()` function call and appends a condition that is always true, bypassing the intended filter. The resulting malicious SQL is executed directly against the application’s checkpoint database, enabling data exfiltration, corruption, or bypass of application-level access controls tied to metadata.
Platform: LangGraph checkpointer
Version: Pre-patch
Vulnerability: SQL Injection
Severity: Critical
date: 2024-XX-XX
Prediction: Patched 2024-05-15
What Undercode Say:
Analytics:
find . -name ".py" -type f -exec grep -l "_metadata_predicate|SqliteSaver" {} \;
pip list | grep langgraph-checkpoint-sqlite
grep -n "json_extract(CAST(metadata" ./path/to/code.py
How Exploit:
malicious_filter = {"x') OR '1'='1--": "dummy"}
results = list(saver.list(None, filter=malicious_filter))
Protection from this CVE:
Update `langgraph-checkpoint-sqlite`.
Validate/restrict filter key input.
Use parameterized queries for all parts.
Impact:
Arbitrary SQL execution.
Data breach.
Access control bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
