Executive brief
LangGraph, a library for building stateful multi-agent applications, is vulnerable to unsafe data processing when loading saved application states (checkpoints). If an attacker gains access to the database or storage where these states are kept, they can insert malicious data that executes unauthorized code when the application resumes. This could allow an attacker who has already breached a storage system to further compromise the application server and access sensitive credentials or environment variables.
Technical details
LangGraph checkpointers utilize msgpack for serializing and deserializing state checkpoints. The deserialization process was found to be unsafe because it could reconstruct arbitrary Python objects from 'ext' types without sufficient validation. An attacker with privileged write access to the persistence layer (e.g., database, shared filesystem) can inject a crafted msgpack payload. When the application loads this checkpoint, the unsafe reconstruction triggers arbitrary code execution. This is considered a defense-in-depth issue as it requires prior access to the storage backend. The fix, introduced in version 1.0.10, implements an allowlist-based hardening mechanism and a strict mode via the LANGGRAPH_STRICT_MSGPACK environment variable.
Affected products
- langchain-ai langgraph <= 1.0.9
Timeline
- 2026-03-05: disclosed
- 2026-03-05: advisory
- 2026-03-05: patched: Fixed in version 1.0.10