AG-SQL: SQL Injection via Tool Parameter

What this rule means

A function passes a tool parameter directly into a SQL execution sink without parameterization. An attacker who can influence that parameter — typically via prompt injection — can send arbitrary SQL.

Why it matters

CVE-2025-67644 (CVSS 7.3): LangGraph's SQLite checkpointer built its `_metadata_predicate()` query via f-string interpolation rather than parameter binding; fixed in 3.0.1.

How to fix it

Use parameterized queries everywhere — never format tool parameters directly into SQL text.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-SQL          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules