Skip to content
AI Sec Watch
MediumVulnerability

GHSA-g48c-2wqr-h844: LangGraph checkpoint loading has unsafe msgpack deserialization

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-28277GHSA-g48c-2wqr-h844
Published
Record updated
View JSON
Affected
  • langgraph <= 1.0.9
Fixed in
No fixed version was stated when the source was last read.
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
5.5%

Summary

LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. An attacker who can write attacker-controlled checkpoint bytes to the backing store, for example after a database compromise, may supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded, potentially leading to code execution in the application runtime. The source states there is no evidence of exploitation in the wild.

Mitigation

LANGGRAPH_STRICT_MSGPACK: when set to a truthy value (1, true, yes), the default msgpack deserialization policy becomes strict, so JsonPlusSerializer() defaults allowed_msgpack_modules to None instead of True unless allowed_msgpack_modules is explicitly passed. Set allowed_msgpack_modules to None for strict mode, which reconstructs only a built-in safe set, or to a list of (module, class_name) tuples to allow exactly the listed symbols in addition to that set. When strict mode is enabled and a StateGraph is compiled, LangGraph derives an allowlist from the graph's schemas and channels and applies it to the checkpointer.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • langgraphPyPILLM dependency since 2024-01-08 · 16 tracked dependents

Related items