GHSA-47pj-3jcm-6whg is a medium-severity (CVSS 5.3) Information Exposure vulnerability in langgraph-checkpoint-postgres. A fix is available for langgraph-checkpoint-postgres — see the affected versions and patch details below.
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-47pj-3jcm-6whg.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-47pj-3jcm-6whg plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,238 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
langgraph-checkpoint-postgres🐍langgraph-checkpoint-sqliteReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.
Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.
We have no evidence of this behavior being exploited in the wild.
Affected users / systems
You may be affected if you:
- use
PostgresStore/AsyncPostgresStoreorSqliteStore/AsyncSqliteStore, and - rely on the namespace to separate data between users or tenants, and
- have namespace labels where one is a prefix of another (
1and12,aliceandalice2), or labels containing_or%
Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.
Three distinct cases were possible:
- Sibling namespaces. A read scoped to
("foo",)also returned items under("foobar",)and("foo2",). - Unescaped pattern metacharacters.
_and%are legal namespace labels — only.is rejected — but were interpolated into the match pattern unescaped, so("user_1",)also matched("userX1",). - Suffix conditions.
list_namespaces(suffix=("alice",))also matched the sibling leafusers.malice.
This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.
Impact
- Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
- No integrity or availability impact.
get,put, anddeletecompare namespaces with=and were never affected; the issue is limited to read paths.
Patches / mitigation
Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.
On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.
Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.
Compatibility
* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.
Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:
list_namespaces(prefix=["uid"], suffix=["alice"])
Applications whose namespace labels cannot be prefixes of one another see no behavioral change.
Operational guidance
- Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
- Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.
LangSmith / hosted deployments note
Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | langgraph-checkpoint-postgres | all versions | 3.1.1pip install --upgrade 'langgraph-checkpoint-postgres==3.1.1' |
| 🐍PyPI | langgraph-checkpoint-sqlite | all versions | 3.1.1pip install --upgrade 'langgraph-checkpoint-sqlite==3.1.1' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langgraph-checkpoint-postgres, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update langgraph-checkpoint-postgres to 3.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-47pj-3jcm-6whg is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-47pj-3jcm-6whg can be triaged on real exposure rather than presence alone.
Tailored to GHSA-47pj-3jcm-6whg. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-47pj-3jcm-6whg in your dependencies?
O3 Security finds GHSA-47pj-3jcm-6whg across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.