Executive brief
The @langchain/langgraph-checkpoint-redis library is used to persist conversation checkpoints in Redis for multi-tenant AI applications. A vulnerability in its filter handling allows attackers to inject RediSearch query syntax through user-controlled filter parameters, bypassing thread isolation and exposing conversation history from other users or tenants. This poses a serious data privacy risk for applications exposing filtering capabilities to end users.
Technical details
The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by interpolating user-provided filter keys and values without escaping RediSearch special characters (-, ., <, >, {, }, [, ], ", ', :, ;, !, @, #, $, %, ^, &, *, (, ), +, =, ~, |, \, ?, /). An attacker can inject the OR operator (|) via filter values to append query clauses matching all threads. For example, injecting "x}) | (@thread_id:{*" into a filter value produces a query like (@thread_id:{user-123-thread}) (@source:{x}) | (@thread_id:{*}), which due to RediSearch precedence rules matches either the intended thread AND source OR any thread, completely bypassing thread isolation. The vulnerability requires only control over filter input values, which is common in user-facing APIs. The patch (1.0.2) introduces proper escaping of all RediSearch special characters and is backward compatible.
Affected products
- LangChain @langchain/langgraph-checkpoint-redis < 1.0.2
Timeline
- 2026-02-18: disclosed: GHSA-5mx2-w598-339m published
- 2026-02-05: patched: Fix merged in PR #1943
- 2026-02-18: other: CVE-2026-27022 assigned
References
- https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-5mx2-w598-339m
- https://github.com/langchain-ai/langgraphjs/pull/1943
- https://github.com/langchain-ai/langgraphjs/commit/814c76dc3938d0f6f7e17ca3bc11d6a12270b2a1
- https://github.com/langchain-ai/langgraphjs
- https://github.com/langchain-ai/langgraphjs/releases/tag/@langchain/langgraph-checkpoint-redis@1.0.2