LangGraph load operations deserialize checkpoint data that is encoded with msgpack, automatically reconstructing Python objects during the process. Based on the description, it is inferred that a crafted payload can influence the reconstruction logic, potentially leading to code execution or compromise of the running process, though the official documentation only states a potential for unsafe object reconstruction.

The vulnerability exists in LangChain AI’s LangGraph package version 1.0.9 and earlier. The affected component is the SQLite‑based checkpoint loader used by LangGraph, which stores checkpoints in a local SQLite database. Any deployment that relies on these older LangGraph versions and allows the checkpoint database to be written to by untrusted parties is exposed.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of 5% suggests a moderate likelihood of exploitation. The vulnerability is not listed in CISA KEV catalog, so no public exploits have been reported yet. The likely attack vector is inferred to involve an attacker who can modify the checkpoint database, for example through database compromise or privileged write access. If an adversary succeeds in injecting a crafted payload into the stored checkpoint, the unsafe deserialization could trigger remote code execution or other compromise of the running process.