CVE-2026-28277
CVSS 6.8 MEDIUM: langGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). EPSS 5% (91st percentile).
Vulnerabilities · 94 days ago
Self-hosted LangGraph deployments can be pushed from state lookup into code execution through the checkpoint store. The break is not the agent’s reasoning loop. It is the persistence layer that reloads stored history as trusted objects, so a bad checkpoint can become executable input.
Check Point says three patched flaws chain in self-hosted SQLite and Redis checkpointers: CVE-2025-67644 in langgraph-checkpoint-sqlite before 3.0.1, CVE-2026-28277 in langgraph before 1.0.10, and CVE-2026-27022 in @langchain/langgraph-checkpoint-redis before 1.0.1. LangChain’s managed LangSmith Deployment is not affected. The exposed pattern is any app that lets user-controlled filters reach checkpoint history and then reloads that state as structured data.
The practical risk is broader than one CVE set. Any self-hosted agent backend that treats stored state as a trust boundary can turn a query into a code-loading path once an attacker can influence what gets written back and re-read.
CVSS 6.8 MEDIUM: langGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). EPSS 5% (91st percentile).
CVSS 7.3 HIGH: langGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). EPSS 2% (82nd percentile).
2 sources covering this story
LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution
Three patched LangGraph flaws could let attackers chain SQL injection and unsafe deserialization for RCE in self-hosted deployments.
From SQLi to RCE - Exploiting LangGraph’s Checkpointer - Check Point Research
Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state.
Part of the PlainSec briefing for 2026-06-12