LangGraph Checkpointer Flaws Could Enable Remote Code Execution
Summary
Check Point researchers detail three LangGraph checkpointer vulnerabilities, including SQL injection flaws and unsafe MessagePack deserialization that can chain to remote code execution under specific conditions. LangChain has patched the issues.
Key points
- Researchers identified SQL injection in LangGraph's SQLite checkpointer (CVE-2025-67644) and Redis checkpointer (CVE-2026-27022), plus unsafe MessagePack deserialization (CVE-2026-28277).
- The SQLite SQL injection and MessagePack flaw can be chained to remote code execution by injecting a fake checkpoint that is deserialized.
- Exploitation requires a self-hosted deployment using an affected checkpointer and an application that exposes get_state_history() with a user-controlled filter.
- Additional SQL injection issues involving integer parameters were found in SQLite and PostgreSQL checkpointers and remediated with parameterized queries.
- LangChain released fixes: langgraph-checkpoint-sqlite 3.0.1+, langgraph 1.0.10+, and langgraph-checkpoint-redis 1.0.2+.
- LangSmith Deployment, which uses PostgreSQL, is not vulnerable to the described checkpointer issues.
Article Details
- Attack Vectors
- An application that exposes get_state_history() with an unsanitized, user-controlled filter can allow SQL injection through filter dictionary keys in the SQLite or Redis checkpointer.
- In the SQLite attack chain, injected SQL adds a fake checkpoint row containing attacker-controlled serialized data, which is then deserialized.
- A crafted MessagePack extension payload can invoke os.system() with attacker-controlled commands, resulting in remote code execution.
- Additional SQL injection issues in SQLite and PostgreSQL checkpointers involved concatenating integer-typed LIMIT or ttl values into queries without parameterized bindings.
- Defensive Notes
- Update to langgraph-checkpoint-sqlite 3.0.1 or later, langgraph 1.0.10 or later, and langgraph-checkpoint-redis 1.0.2 or later, as applicable.
- Do not expose get_state_history() with user-controlled filter values unless the input is appropriately sanitized.
- Use parameterized queries rather than concatenating values into SQL statements.
- LangChain's managed cloud service, LangSmith Deployment, uses PostgreSQL and is reported not vulnerable to the three vulnerabilities described.
CVE
CVE-2025-67644Two of them chain into remote code execution: a SQL injection in the SQLite checkpointer (CVE-2025-67644) and an unsafe msgpack deserialization (CVE-2026-28277).CVE-2026-27022A third, parallel issue (CVE-2026-27022) introduces the same injection class into the Redis checkpointer.CVE-2026-28277Two of them chain into remote code execution: a SQL injection in the SQLite checkpointer (CVE-2025-67644) and an unsafe msgpack deserialization (CVE-2026-28277).
People
Vendors
Products
LangGraphFrom SQLi to RCE – Exploiting LangGraph’s Checkpointerlanggraph-checkpoint-redisUsers should update to langgraph-checkpoint-sqlite 3.0.1+, langgraph 1.0.10+, and langgraph-checkpoint-redis 1.0.2+.langgraph-checkpoint-sqliteUsers should update to langgraph-checkpoint-sqlite 3.0.1+, langgraph 1.0.10+, and langgraph-checkpoint-redis 1.0.2+.LangSmith DeploymentLangChain’s managed cloud service, LangSmith Deployment (formerly LangGraph Platform), runs PostgreSQL and is not vulnerable.PostgreSQLLangChain’s managed cloud service, LangSmith Deployment (formerly LangGraph Platform), runs PostgreSQL and is not vulnerable.SQLiteTwo of them chain into remote code execution: a SQL injection in the SQLite checkpointer (CVE-2025-67644) and an unsafe msgpack deserialization (CVE-2026-28277).