EUVD-2026-37140
GHSA-fjqc-hq36-qh5p
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SQLite is a local file resource requiring filesystem write access, so AV:L and PR:H are most precise; code execution yields full CIA impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Blast Radius
ecosystem impact- 5 pypi packages depend on langgraph-checkpoint (4 direct, 1 indirect)
Ecosystem-wide dependent count for version 4.1.1.
DescriptionCVE.org
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime. This issue has been fixed in version 4.1.1.
AnalysisAI
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary Python object reconstruction from checkpoint payloads stored in a SQLite backing store, enabling code execution at checkpoint load time. Affected deployments are those where an unauthorized party can modify checkpoint bytes at rest - a high-privilege prerequisite (PR:H, AV:A per CVSS) that already implies a significant prior compromise. This is explicitly framed as a defense-in-depth concern: the issue escalates an existing 'checkpoint-store write access' incident into full application runtime code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
LangGraph is a Python-based AI orchestration framework built on LangChain; its SQLite Checkpoint component (cpe:2.3:a:langchain-ai:langraph-checkpoint) persists and restores execution state (checkpoints) to a SQLite database, including support for both synchronous and asynchronous (aiosqlite) backends. The JsonPlusSerializer class is responsible for serializing and deserializing checkpoint payloads. CWE-502 (Deserialization of Untrusted Data) is the root cause: the serializer can reconstruct arbitrary Python objects from JSON-encoded checkpoint data, analogous to unsafe use of Python's pickle or yaml.load() - any Python object expressible in the payload format can be instantiated, including those with dangerous __reduce__ or __init__ side effects. The vulnerability manifests because the deserialization path does not enforce an allowlist of safe types, trusting that the backing SQLite store has not been tampered with.
RemediationAI
Vendor-released patch: version 4.1.1. Upgrade langgraph-checkpoint to 4.1.1 or later via pip (pip install --upgrade langgraph-checkpoint), which resolves the unsafe deserialization path in JsonPlusSerializer. Full advisory is available at https://github.com/langchain-ai/langgraph/security/advisories/GHSA-fjqc-hq36-qh5p. If immediate upgrade is not possible, the primary compensating control is hardening access to the SQLite backing store: restrict file system or network share permissions so only the application process user can write to the checkpoint database, reducing the attacker's ability to satisfy the prerequisite. Note that this mitigation addresses the precondition rather than the flaw itself. Additionally, deployers may consider validating checkpoint integrity with an HMAC or similar mechanism before deserialization, though this requires application-level changes and is not a substitute for patching.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today