Check Point Research discovered how a single overlooked API in LangGraph, one of the world’s most widely used AI agent frameworks, can hand an attacker complete control of your AI infrastructure.
LangGraph is not a niche tool. With close to 46.5 million downloads last month alone, it powers AI agents across thousands of production environments, from customer support automation to internal enterprise workflows. That kind of adoption means any security issue in it is worth paying close attention to.
When Check Point Research set out to understand how AI agent frameworks handle persistence and state, we did not expect to find a path to full remote code execution. But that is exactly what we uncovered inside LangGraph, hidden in the component responsible for saving and retrieving agent memory.
Unlike a simple chatbot, a stateful AI agent needs to remember what it has done across multiple steps. LangGraph handles this through a component called a checkpointer, a persistence layer that saves the agent’s execution state at each step so it can be retrieved later.
This is where our research focused. The checkpointer is deeply embedded in how LangGraph operates, and any vulnerability here sits directly in the execution path of the entire agent workflow.
Our team discovered that LangGraph’s get_state_history() function, which retrieves historical agent checkpoints, contains an SQL injection vulnerability in its filter parameter. On its own, that is already serious. But chained with a second vulnerability in how LangGraph deserializes checkpoint data, it becomes a path to full remote code execution.
Figure 1: SQLite checkpointer database schema used by LangGraph to store agent execution state, including thread identifiers, checkpoint data, and metadata blobs.
Individual bugs are common. What makes this research significant is how two vulnerabilities combine into something far more serious than either one alone. The SQL injection allows an attacker to manipulate which checkpoint data gets returned from the database. The deserialization vulnerability means that when LangGraph processes that returned data, an attacker-controlled payload gets executed as code on the server. Neither flaw alone tells the full story. Together, they create a clear path from a single API call to complete server compromise.
Three CVEs were assigned across the SQLite checkpointer, the Redis checkpointer, and the core deserialization mechanism. We worked directly with the LangChain team through the full disclosure process, helping design and validate the fixes.
Full code execution on a LangGraph server is not a contained incident. These servers hold the keys to everything the agent touches.
This is categorically different from a prompt injection attack that affects a single agent session. A compromised server means an attacker can read every conversation that agent has ever processed and hijack its behavior entirely going forward. This could effectively manipulate the AI into performing unauthorized actions, spreading of misinformation, or impersonating trusted systems. In effect, the AI shifts from being a trusted assistant to a potentially compromised tool that can create serious operational, security, and trust risks for the organization.
Figure 2: End-to-end attack chain from SQL injection in get_state_history() to remote code execution via msgpack deserialization.
LangGraph is a framework, not a hosted product. That means every team using it is effectively self-hosting it inside their own application. The vulnerability chain is exploitable when an application exposes get_state_history() with a user-controllable filter parameter, and uses either the SQLite or Redis checkpointer backend. LangChain’s own managed platform uses PostgreSQL and is not affected by this specific chain.
All three vulnerabilities have been fixed. Teams running the SQLite checkpointer should update to langgraph-checkpoint-sqlite 3.0.1 or later to address CVE-2025-67644. The msgpack deserialization issue, CVE-2026-28277, is resolved in langgraph 1.0.10 or later. And for those using the Redis checkpointer, CVE-2026-27022 is patched in langgraph-checkpoint-redis 1.0.2 or later. If you are running any version below these, updating the patch should be the immediate priority to prevent any impact.
These vulnerabilities are now patched, and all users should upgrade immediately. But the more durable takeaway from this research is what it reveals about how teams should be approaching AI agent security more broadly.
Interested in how Check Point can help secure your agentic AI deployments? Contact us here.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。