# LangGraph Checkpointer: Chained SQLi-to-RCE via Unsafe msgpack Deserialization (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022)

> Check Point Research (Yarden Porat) disclosed three chained vulnerabilities in LangGraph's persistence (checkpointer) layer for AI agent state. An unsanitized metadata filter key reachable via get_state_history() enables SQL/RediSearch injection (CVE-2025-67644 SQLite, CVE-2026-27022 Redis) to insert an attacker-controlled checkpoint row whose malicious msgpack payload, on load, triggers arbitrary command execution through importlib.import_module + os.system (CVE-2026-28277), yielding remote code execution.

- **Published:** 2026-06-11T00:00:00Z
- **Last reviewed:** 2026-06-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0778
- **ID:** TL-2026-0778
- **Severity:** CRITICAL (CVSS 7.3)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-67644, CVE-2026-28277, CVE-2026-27022

## Description

LangGraph is a widely deployed Python framework (50+ million monthly PyPI downloads) for building stateful AI agents. Agent execution state is persisted through pluggable 'checkpointer' backends (SQLite, Redis, Postgres). Check Point Research demonstrated that two distinct vulnerability classes in the self-hosted SQLite and Redis checkpointers can be chained into full remote code execution.

The attack surface is the public get_state_history() method (and the underlying SqliteSaver.list()/alist() and RedisSaver/ShallowRedisSaver search paths), which accept a user-controlled metadata `filter` argument. In the SQLite checkpointer (CVE-2025-67644, CWE-89), the internal _metadata_predicate() helper builds the WHERE clause with an f-string: f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}". Filter VALUES are bound as parameters, but filter KEYS are interpolated directly, so an attacker-controlled key injects arbitrary SQL. In the Redis checkpointer (CVE-2026-27022, CWE-74), RedisSaver and ShallowRedisSaver build RediSearch queries by interpolating filter keys and values without escaping RediSearch special syntax, enabling query injection.

The injection alone bypasses filtering and leaks all checkpoint records (thread IDs, conversation state, metadata). Chained, it is far worse: the attacker uses a UNION SELECT (SQLite) / crafted query to insert a fake checkpoint row carrying a malicious msgpack-serialized blob. When LangGraph later deserializes that checkpoint via JsonPlusSerializer.loads_typed() in msgpack mode, the _msgpack_ext_hook() handler processes an EXT_CONSTRUCTOR_SINGLE_ARG extension type and executes effectively `getattr(importlib.import_module(tup[0]), tup[1])(tup[2])` — i.e. importlib.import_module('os').system('<command>'). This is CVE-2026-28277 (CWE-502), reconstructing arbitrary Python objects from untrusted checkpoint bytes and reaching os.system for command execution in the application runtime, exposing environment variables and cloud credentials available to the process.

Managed LangSmith Deployment (which uses PostgreSQL and disallows custom checkpointers) is not affected; the risk is concentrated in self-hosted SQLite/Redis deployments that expose checkpoint-history endpoints accepting untrusted metadata filter keys. There is no confirmed exploitation in the wild as of disclosure; the work is a researcher PoC. Fixes: langgraph-checkpoint-sqlite 3.0.1 (strict key regex ^[a-zA-Z0-9_.-]+$), langgraph-checkpoint-redis 1.0.2, langgraph-checkpoint 4.0.1, and langgraph 1.0.10 (msgpack allowlist / LANGGRAPH_STRICT_MSGPACK strict mode and allowed_msgpack_modules).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1587 Develop Capabilities
- T1505 Server Software Component
- T1083 File and Directory Discovery
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [From SQLi to RCE - Exploiting LangGraph's Checkpointer](https://research.checkpoint.com/2026/from-sqli-to-rce-exploiting-langgraphs-checkpointer/)
- [GHSA-9rwj-6rc7-p77c - SQL injection via metadata filter key in SQLite checkpointer list method](https://github.com/langchain-ai/langgraph/security/advisories/GHSA-9rwj-6rc7-p77c)
- [CVE-2025-67644 - langgraph-checkpoint-sqlite SQL Injection (GitLab Advisories)](https://advisories.gitlab.com/pypi/langgraph-checkpoint-sqlite/CVE-2025-67644/)
- [SQL Injection in langgraph-checkpoint-sqlite (Snyk)](https://security.snyk.io/vuln/SNYK-PYTHON-LANGGRAPHCHECKPOINTSQLITE-14361682)
- [GHSA-g48c-2wqr-h844 - LangGraph checkpoint loading has unsafe msgpack deserialization (CVE-2026-28277)](https://github.com/advisories/GHSA-g48c-2wqr-h844)
- [CVE-2026-28277 - LangGraph unsafe msgpack deserialization (GitLab Advisories)](https://advisories.gitlab.com/pkg/pypi/langgraph/CVE-2026-28277/)
- [CVE-2026-27022 - RediSearch Query Injection in langgraph-checkpoint-redis (SmartScanner)](https://www.thesmartscanner.com/vulnerability-list/redisearch-query-injection-in-langchain-langgraph-checkpoint-redis)
- [Red Hat CVE-2026-27022](https://access.redhat.com/security/cve/cve-2026-27022)
- [PoC: CVE-2025-67644 LangGraph SQLite Checkpoint SQL Injection](https://github.com/mbanyamer/CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection)
- [Critical Flaw in LangGraph Allows Remote Code Execution via Deserialization](https://cyberpress.org/flaw-in-langgraph/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0778