EUVD-2026-37140
GHSA-fjqc-hq36-qh5p
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SQLite is a local file resource requiring filesystem write access, so AV:L and PR:H are most precise; code execution yields full CIA impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime. This issue has been fixed in version 4.1.1.
AnalysisAI
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary Python object reconstruction from checkpoint payloads stored in a SQLite backing store, enabling code execution at checkpoint load time. Affected deployments are those where an unauthorized party can modify checkpoint bytes at rest - a high-privilege prerequisite (PR:H, AV:A per CVSS) that already implies a significant prior compromise. This is explicitly framed as a defense-in-depth concern: the issue escalates an existing 'checkpoint-store write access' incident into full application runtime code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
LangGraph is a Python-based AI orchestration framework built on LangChain; its SQLite Checkpoint component (cpe:2.3:a:langchain-ai:langraph-checkpoint) persists and restores execution state (checkpoints) to a SQLite database, including support for both synchronous and asynchronous (aiosqlite) backends. The JsonPlusSerializer class is responsible for serializing and deserializing checkpoint payloads. CWE-502 (Deserialization of Untrusted Data) is the root cause: the serializer can reconstruct arbitrary Python objects from JSON-encoded checkpoint data, analogous to unsafe use of Python's pickle or yaml.load() - any Python object expressible in the payload format can be instantiated, including those with dangerous __reduce__ or __init__ side effects. The vulnerability manifests because the deserialization path does not enforce an allowlist of safe types, trusting that the backing SQLite store has not been tampered with.
RemediationAI
Vendor-released patch: version 4.1.1. Upgrade langgraph-checkpoint to 4.1.1 or later via pip (pip install --upgrade langgraph-checkpoint), which resolves the unsafe deserialization path in JsonPlusSerializer. Full advisory is available at https://github.com/langchain-ai/langgraph/security/advisories/GHSA-fjqc-hq36-qh5p. If immediate upgrade is not possible, the primary compensating control is hardening access to the SQLite backing store: restrict file system or network share permissions so only the application process user can write to the checkpoint database, reducing the attacker's ability to satisfy the prerequisite. Note that this mitigation addresses the precondition rather than the flaw itself. Additionally, deployers may consider validating checkpoint integrity with an HMAC or similar mechanism before deserialization, though this requires application-level changes and is not a substitute for patching.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today