GHSA-fjqc-hq36-qh5p: LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

Summary

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads, so an attacker with write access to checkpoint bytes at rest could potentially trigger code execution at checkpoint load time. The issue is classed as defense-in-depth: it is reachable only when an unauthorized party can modify the checkpoint store, and the team reports no evidence of exploitation in the wild. The default serializer in PostgresSaver, SqliteSaver and their async counterparts is JsonPlusSerializer, so applications generally fall in scope without opting in.

Mitigation

The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. Freshly written checkpoints are unaffected, and legacy payloads that used the default constructor as their first option still revive. Pre-October-2025 pydantic model checkpoints that relied on a no-validation fallback factory now return None from the revival path and surface as raw dicts. Operational guidance: restrict write access to checkpoint stores, rotate credentials if unauthorized access is suspected, and avoid custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langgraph-checkpointPyPILLM dependency since 2024-08-02 · 7 tracked dependents

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database