The @langchain/langgraph-checkpoint-redis package incorporates user-supplied filter keys and values directly into RediSearch queries without proper escaping. Because RediSearch includes special syntax characters that control query logic, an attacker can craft a filter key or value containing these characters to alter the query’s evaluation. The flaw can therefore allow the attacker to read data they should not access, compromising confidentiality. The weakness is a classic example of query injection (CWE-74).

This vulnerability affects all releases of langchain-ai:langgraphjs's @langchain/langgraph-checkpoint-redis component earlier than version 1.0.2. Deployments that use the RedisSaver or ShallowRedisSaver classes with user-controlled filter parameters are vulnerable. The issue exists in the Redis checkpoint implementation that relies on RediSearch for indexing and querying.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of 4% suggests a modest probability of exploitation in the wild. The vulnerability is not yet cataloged as a known exploited vulnerability (not in KEV). Exploitation would require the attacker to supply a crafted filter payload through the application's interface that forwards filter keys and values to the package. The likely attack vector is through user input passed to RedisSaver or ShallowRedisSaver; based on the description, it is inferred that the attacker would supply the filter payload via the application's API calling these classes.