Breaking

LangGraph Patches Three Flaws That Could Chain Into RCE

June 12, 2026 at 05:59 EDT

AI Agents
Security
Open Source

Three vulnerabilities have been disclosed in "checkpointer," the state-persistence layer of LangGraph, a framework widely used to build AI agents, allowing an attacker to chain SQL injection with unsafe deserialization to reach remote code execution (RCE). LangChain/LangGraph has shipped fixes for all three, with self-hosted deployments using a SQLite or Redis checkpointer facing the primary risk.

March 2026 · Coordinated Disclosure

From SQL Injection to RCE: A "Poisoned Checkpoint" Can Hijack LangGraph Agents

Three now-patched flaws in LangChain / LangGraph let an attacker chain SQL injection with unsafe deserialization to take over self-hosted agent servers — by targeting the very "memory" that AI agents persist between sessions.

vulnerabilities disclosed across LangChain & LangGraph

9.3

top CVSS — unsafe deserialization in langchain-core

50–60M

weekly PyPI downloads combined

The attack chain · poisoned checkpoint → server takeover

1 · SQL INJECTION

Malicious filter key + UNION SELECT inserts a forged checkpoint row

→

2 · DESERIALIZATION

msgpack restore invokes a custom extension handler on attacker data

→

3 · RCE

os.system() / importlib runs code → full server takeover

At risk

Self-hosted SQLite / Redis checkpointers — exploitable when user-controlled filter parameters reach methods like get_state_history().

Not affected

The LangSmith managed service, which uses PostgreSQL, is reported unaffected — managed services are recommended where possible.

Patched — update now

langgraph-checkpoint-sqlite

≥ 3.0.1

langgraph-checkpoint-redis

≥ 1.0.2

Fixes convert the f-string SQL to a parameterized query and tighten deserialization. No large-scale incidents confirmed publicly so far — audit any app exposing get_state_history().

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.