CVE-2026-48775 — LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

Affected: langchain-ai langgraph, langchain-ai langraph-checkpoint

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime. This issue has been fixed in version 4.1.1.

GHSA-fjqc-hq36-qh5p — LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

Affected: PyPI: langgraph-checkpoint

## Summary

LangGraph's `JsonPlusSerializer` can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time.

This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime.

There is no evidence of this behavior being triggered in the wild, and the team is not aware of a practical path to it in existing deployments today. This change is intended to reduce the surface available after a checkpoint-store incident.

## Affected users / systems

Users may be affected if they:

- use a persistent checkpointer (database, remote store, shared filesystem, etc.) with the default `JsonPlusSerializer`, - load/resume from checkpoints, and - operate in an environment where write access to the checkpoint store could be obtained by an unauthorized party.

The default checkpoint serializer in all shipped checkpointer backends (`PostgresSaver`, `SqliteSaver`, and their async counterparts) is `JsonPlusSerializer`, so applications generally do not need to opt in to…

Most recent entries from all

CVE-2026-48775 — LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

GHSA-fjqc-hq36-qh5p — LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading