TLDR Tech / InfoSec
From SQLi to RCE - Exploiting LangGraph's Checkpointer
Check Point Research disclosed three chained vulnerabilities in LangGraph's persistence layer affecting 50M+ monthly downloads: CVE-2025-67644 (SQL injection in SQLite checkpointer when filter parameters lack parameterization), CVE-2026-28277 (unsafe msgpack deserialization via _msgpack_ext_hook that executes arbitrary functions through importlib.import_module and getattr), and CVE-2026-27022 (identical SQL injection in Redis checkpointer). Exploitation requires the application to expose get_state_history() with user-controlled filter input. Attackers inject UNION SELECT statements containing malicious msgpack payloads that deserialize to RCE via os.system() calls during checkpoint processing. Patch to langgraph-checkpoint-sqlite 3.0.1+, langgraph 1.0.10+, and langgraph-checkpoint-redis 1.0.2+. Use parameterized queries for all filter/limit inputs and avoid exposing checkpoint history APIs to untrusted users.
Read the full story