Overview
Check Point Research has disclosed three vulnerabilities in LangGraph’s checkpointer persistence layer, the component responsible for storing and retrieving AI agent execution state. Two of the flaws — a SQL injection (CVE-2025-67644) and an unsafe msgpack deserialization (CVE-2026-28277) — chain together to enable unauthenticated remote code execution on self-hosted deployments. A third vulnerability (CVE-2026-27022) introduces the same injection class into the Redis checkpointer. LangGraph records over 50 million monthly PyPI downloads, making the blast radius significant for teams running their own AI agent infrastructure.
Technical Analysis
The root cause of CVE-2025-67644 lies in LangGraph’s _metadata_predicate function, which builds SQL WHERE clauses for checkpoint queries. When the list() function is called with a user-supplied filter dictionary, the dictionary’s keys are interpolated directly into a json_extract() SQL expression without parameterisation:
predicates.append(
f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}"
)
Because query_key is never sanitised, an attacker who controls the filter argument can inject arbitrary SQLite expressions. SQLite’s writefile() or similar mechanisms can then be leveraged to write attacker-controlled data to disk.
CVE-2026-28277 escalates the impact to RCE. LangGraph deserialises checkpoint payloads using msgpack without restricting object types. An attacker who can write a malicious checkpoint blob — possible via the SQLi primitive above — can craft a msgpack payload that executes arbitrary Python on deserialisation, completing the exploit chain.
CVE-2026-27022 mirrors the SQLi pattern in the Redis checkpointer, where metadata filter keys are similarly unsanitised before being used in Redis query construction.
Framework Mapping
- AML.T0047 (ML-Enabled Product or Service): The attack surface is the LangGraph agent framework itself; exploitation requires no model access, only interaction with the persistence API.
- AML.T0010 (ML Supply Chain Compromise): LangGraph is a foundational dependency for a large portion of the LLM application ecosystem; a vulnerable version in a shared environment propagates risk broadly.
- LLM05 (Supply Chain Vulnerabilities): The flaws exist in a widely adopted open-source AI infrastructure package.
- LLM07 (Insecure Plugin Design): The checkpointer acts as a plugin/extension to LangChain, and its failure to sanitise inputs exemplifies insecure plugin design at the framework level.
Impact Assessment
The critical path requires that an attacker control a value passed to get_state_history() or list() filter parameters — a realistic scenario in multi-tenant or user-facing agent deployments. LangChain’s managed LangSmith Deployment (formerly LangGraph Platform) uses PostgreSQL and is confirmed unaffected. Self-hosted deployments using SQLite or Redis checkpointers are the primary risk surface. Successful exploitation yields OS-level code execution on the host running the LangGraph process, with full access to agent memory, secrets, and downstream infrastructure.
Mitigation & Recommendations
- Patch immediately: Upgrade to
langgraph-checkpoint-sqlite >= 3.0.1,langgraph >= 1.0.10, andlanggraph-checkpoint-redis >= 1.0.2. - Audit filter inputs: Identify every call site where user-controlled data reaches
list()orget_state_history()filter arguments and apply strict allowlist validation. - Restrict backend access: Ensure SQLite files and Redis instances are not network-accessible beyond the application process; apply principle of least privilege to host filesystem permissions.
- Consider managed deployment: LangChain’s cloud-managed offering is not vulnerable; teams without the capacity to maintain patched self-hosted infrastructure should evaluate migration.