SQL Injection

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. SQL Injection in langchain-ai/langchainCVE-2024-8309langchain-ai · CVSS 4.9 · 14% likely

   CWE-89

2. LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodCVE-2025-67644langchain-ai · CVSS 7.3 · 2.5% likelycovered by CyberSIXT

   CWE-89

3. LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureCVE-2026-55253langchain-ai · CVSS 7.7 · 0.5% likely

   CWE-943

4. LangChain: MongoDBChatMessageHistory query injection can allow cross-session accessCVE-2026-106119langchain-ai · CVSS 6 · 0.5% likely

   CWE-943

5. @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state accessCVE-2026-48121langchain-ai · CVSS 6.7 · 0.3% likely

   CWE-943

6. Prompt Injection in langchain-ai/langchainjs Leading to SQL InjectionCVE-2024-7042langchain-ai · CVSS 4.9 · 0.3% likely

   CWE-89

7. LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesCVE-2026-105799langchain-ai · CVSS 2.3 · 0.3% likely

   CWE-943

8. LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStoreCVE-2025-64104langchain-ai · CVSS 7.3 · 0.2% likely

   CWE-89

9. SQL Injection in langchain-ai/langchainCVE-2025-8709langchain-ai · CVSS 7.3 · 0.2% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.