Is CVE-2026-27022 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27022 being exploited in the wild.

How severe is CVE-2026-27022?

Low severity, with a CVSS score of 3.1, published 18 February 2026.

Which products and versions are affected?

@langchain/langgraph-checkpoint-redis (npm) SEMVER:introduced=0,fixed=1.0.2.

Is there a fix for CVE-2026-27022?

Yes. @langchain/langgraph-checkpoint-redis (npm): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27022 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27022?

Check whether you run LangChain LangGraph Checkpoint Redis or @langchain/langgraph-checkpoint-redis (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27022: LangChain RediSearch query injection in langgraph-checkpoint-redis

CVE-2026-27022 · Severity: low · CVSS 3.1 · Published 2026-02-18

The @langchain/langgraph-checkpoint-redis library is used to persist conversation checkpoints in Redis for multi-tenant AI applications. A vulnerability in its filter handling allows attackers to inject RediSearch query syntax through user-controlled filter parameters, bypassing thread isolation and exposing conversation history from other users or tenants. This poses a serious data privacy risk for applications exposing filtering capabilities to end users.

Vendors: LangChain, npm.

Quick answers

Is CVE-2026-27022 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27022 being exploited in the wild.
How severe is CVE-2026-27022?: Low severity, with a CVSS score of 3.1, published 18 February 2026.
Which products and versions are affected?: @langchain/langgraph-checkpoint-redis (npm) SEMVER:introduced=0,fixed=1.0.2.
Is there a fix for CVE-2026-27022?: Yes. @langchain/langgraph-checkpoint-redis (npm): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27022 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27022?: Check whether you run LangChain LangGraph Checkpoint Redis or @langchain/langgraph-checkpoint-redis (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@langchain/langgraph-checkpoint-redis (npm): upgrade to 1.0.2 or later
```
npm install @langchain/langgraph-checkpoint-redis@1.0.2
```

Technical details

The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by interpolating user-provided filter keys and values without escaping RediSearch special characters (-, ., <, >, {, }, [, ], ", ', :, ;, !, @, #, $, %, ^, &, *, (, ), +, =, ~, |, \, ?, /). An attacker can inject the OR operator (|) via filter values to append query clauses matching all threads. For example, injecting "x}) | (@thread_id:{*" into a filter value produces a query like (@thread_id:{user-123-thread}) (@source:{x}) | (@thread_id:{*}), which due to RediSearch precedence rules matches either the intended thread AND source OR any thread, completely bypassing thread isolation. The vulnerability requires only control over filter input values, which is common in user-facing APIs. The patch (1.0.2) introduces proper escaping of all RediSearch special characters and is backward compatible.

Affected products

LangChain @langchain/langgraph-checkpoint-redis < 1.0.2

Identifiers

CVE-2026-27022
GHSA-5mx2-w598-339m

Timeline

2026-02-18: disclosed: GHSA-5mx2-w598-339m published
2026-02-05: patched: Fix merged in PR #1943
2026-02-18: other: CVE-2026-27022 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.