An injection flaw in the @langchain/langgraph-checkpoint-redis package allows an attacker to manipulate RediSearch queries by supplying crafted filter keys and values. Because the package concatenates user input directly into queries without proper escaping, special characters can alter the query logic, potentially bypassing intended access controls. This flaw can lead to unauthorized read or modification of stored data, impacting confidentiality and integrity.

LangGraph’s Redis checkpoint implementation, specifically langchain-ai:langgraphjs’s @langchain/langgraph-checkpoint-redis component, is affected. The vulnerability exists in all releases prior to 1.0.2; the fix was released in 1.0.2. Deployments that use the RedisSaver or ShallowRedisSaver classes with user‑controlled filters are at risk.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low current exploitation probability, and it is not marked as a known exploited vulnerability. Exploits would likely be performed by an attacker with legitimate or compromised application access who supplies a crafted filter payload; the unescaped input can alter RediSearch query evaluation and bypass intended access checks. Although no authentication bypass is required beyond the application context, the impact on data confidentiality and integrity is significant.