Most recent entries from all

EUVD-2026-270757

fkie_cve-2026-27794

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from `BaseCache` and opt nodes into caching via `CachePolicy`. Prior to `langgraph-checkpoint` 4.0.0, `BaseCache` defaults to `JsonPlusSerializer(pickle_fallback=True)`. When msgpack serialization fails, cached values can be deserialized via `pickle.loads(...)`. Caching is not enabled by default. Applications are affected only when the application explicitly enables a cache backend (for example by passing `cache=...` to `StateGraph.compile(...)` or otherwise configuring a `BaseCache` implementation), one or more nodes opt into caching via `CachePolicy`, and the attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file). An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them. This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume). Because ex…

GHSA-mhr3-j7m5-c7c9 — LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

Affected: PyPI: langgraph-checkpoint

## Context

A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from `BaseCache` and opt nodes into caching via `CachePolicy`. Prior to `langgraph-checkpoint` 4.0.0, `BaseCache` defaults to `JsonPlusSerializer(pickle_fallback=True)`. When msgpack serialization fails, cached values can be deserialized via `pickle.loads(...)`.

### Who is affected?

Caching is not enabled by default. Applications are affected only when:

- The application explicitly enables a cache backend (for example by passing `cache=...` to `StateGraph.compile(...)` or otherwise configuring a `BaseCache` implementation) - One or more nodes opt into caching via `CachePolicy` - The attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file)

Example (enabling a cache backend and opting a node into caching):

```py from langgraph.cache.memory import InMemoryCache from langgraph.graph import StateGraph from langgraph.types import CachePolicy

def my_node(state: dict) -> dict: return {"value": state.get("value", 0) + 1}

builder = StateGraph(dict) builder.add_node("my_node", my_node, cache_policy=CachePolicy(ttl=120)) builder.set_entry_point("my_node")

graph = builder.compile(cache=InMemoryCache())

result = graph.invoke({"value": 1}) ```

With `pickle_fallback=True`, when msgpack serial…

PYSEC-2026-2574 — LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution