Full Report
By Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? Key Points Background LangGraph is an open-source framework for building stateful, multi-agent AI systems with built-in persistence. It’s an extension of LangChain, with over […] The post From SQLi to RCE – Exploiting LangGraph’s Checkpointer appeared first on Check Point Research.
Analysis Summary
# Vulnerability: Chained SQL Injection and Deserialization in LangGraph Checkpointers
## CVE Details
- **CVE ID:** CVE-2025-67644 (SQL Injection), CVE-2026-28277 (Unsafe Deserialization), CVE-2026-27022 (Redis Injection)
- **CVSS Score:** Not explicitly listed, but rated as **Critical** due to RCE potential.
- **CWE:** CWE-89 (SQL Injection), CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** LangGraph (Open-source framework for AI agents)
- **Versions:**
- LangGraph versions prior to 1.0.10
- `langgraph-checkpoint-sqlite` versions prior to 3.0.1
- `langgraph-checkpoint-redis` versions prior to 1.0.2
- `langgraph-checkpoint` (core) versions prior to 4.0.1
- **Configurations:** Self-hosted LangGraph instances where the application exposes the `get_state_history()` or `list()` functions with a user-controlled `filter` parameter.
## Vulnerability Description
Researchers discovered a vulnerability chain that allows for Remote Code Execution (RCE) via LangGraph’s persistence layer (checkpointers):
1. **SQL Injection (CVE-2025-67644 / CVE-2026-27022):** The SQLite and Redis checkpointers fail to properly sanitize the `query_key` in the `filter` dictionary. In SQLite, the `_metadata_predicate` function uses f-strings to construct SQL queries, allowing an attacker to escape the JSON path and inject arbitrary SQL.
2. **Unsafe Deserialization (CVE-2026-28277):** The framework uses `msgpack` for storing execution state. By using the SQL injection to manipulate the returned data from a `list()` or `get_state_history()` call, an attacker can force the application to deserialize a malicious payload, leading to RCE.
**Note:** LangChain’s managed service (LangSmith Deployment/LangGraph Platform) is **not** vulnerable as it utilizes PostgreSQL, which was not affected by this specific injection pattern.
## Exploitation
- **Status:** PoC available (developed by Check Point Research); independently discovered by multiple researchers.
- **Complexity:** Medium (Requires chaining an injection to a deserialization sink).
- **Attack Vector:** Network (via any application interface that exposes state filtering to users).
## Impact
- **Confidentiality:** High (Full access to the database and underlying server)
- **Integrity:** High (Ability to modify agent state and execute arbitrary code)
- **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
Users should update to the following versions or higher:
- `langgraph >= 1.0.10`
- `langgraph-checkpoint-sqlite >= 3.0.1`
- `langgraph-checkpoint-redis >= 1.0.2`
- `langgraph-checkpoint >= 4.0.1`
### Workarounds
- **Input Validation:** Ensure that any `filter` parameters passed to `list()` or `get_state_history()` are strictly validated against a whitelist of expected keys.
- **Access Control:** Do not expose checkpointer query functions directly to untrusted users or the public internet.
## Detection
- **Indicators of Compromise:** Unusual SQL syntax in application logs involving `json_extract` or the `checkpoints` table. Presence of serialized `msgpack` payloads containing unexpected OS command execution patterns.
- **Detection methods:** Static analysis of code for unvalidated use of the `filter` parameter in LangGraph persistence calls.
## References
- Vendor Advisory: [https://github.com/langchain-ai/langgraph/security/advisories]
- Original Research: [https://research.checkpoint.com/2026/from-sqli-to-rce-exploiting-langgraphs-checkpointer/]