MediumVulnerability
GHSA-5mx2-w598-339m: RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
- Identifiers
- CVE-2026-27022GHSA-5mx2-w598-339m
- Published
- Record updated
- Affected
- @langchain/langgraph-checkpoint-redis < 1.0.2
- Fixed in
- 1.0.2
- released February 4, 2026, 13 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 4.0%
Summary
The @langchain/langgraph-checkpoint-redis package contains a RediSearch query injection flaw in the list() methods of RedisSaver and ShallowRedisSaver. Filter keys and values are interpolated without escaping, so an attacker controlling a filter value can inject an OR clause such as `}) | (@thread_id:{*` that matches all threads and bypasses thread isolation, exposing checkpoint data from other users in multi-tenant applications.
Mitigation
The 1.0.2 patch adds an escapeRediSearchTagValue() function that escapes RediSearch special characters and applies escaping to all filter keys before query construction.
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database