EUVD-2026-270443

fkie_cve-2026-27022

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls. This vulnerability is fixed in 1.0.2.

GHSA-5mx2-w598-339m — RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

Affected: npm: @langchain/langgraph-checkpoint-redis

## Summary

A query injection vulnerability exists in the `@langchain/langgraph-checkpoint-redis` package's filter handling. The `RedisSaver` and `ShallowRedisSaver` classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls.

## Attack surface

The core vulnerability was in the `list()` methods of both `RedisSaver` and `ShallowRedisSaver`: these methods failed to escape RediSearch special characters in filter keys and values when constructing queries. When unescaped data containing RediSearch syntax was used, the injected operators were interpreted by RediSearch rather than treated as literal search values.

This escaping bug enabled the following attack vector:

- **Thread boundary escape via OR operator**: RediSearch uses `|` as an OR operator with specific precedence rules. A query like `A B | C` is interpreted as `(A AND B) OR C`. By injecting `}) | (@thread_id:{*` into a filter value, an attacker can append an OR clause that matches all threads, effectively bypassing the thread isolation constraint.

The injected query `(@thread_id:{legitimate-thread}) (@source:{x}) | (@thread_id:{*})` matches:

- Documents with `thread_id:legitimate-thread AND source:x`, OR - Documents with ANY `thread_id`

The second claus…

Most recent entries from all

EUVD-2026-270443

fkie_cve-2026-27022

GHSA-5mx2-w598-339m — RediSearch Query Injection in @langchain/langgraph-checkpoint-redis