LangGraph SQLite Checkpoint implements a checkpoint saver that uses a JSON‑based serializer capable of reconstructing Python objects. In versions 4.1.0 and earlier, the JsonPlusSerializer used during checkpoint loading accepts arbitrary JSON payloads and can instantiate objects beyond the intended set. If an attacker is able to alter the JSON bytes stored in the backing SQLite database, deserialization can rebuild these objects, potentially leading to execution of arbitrary code at load time. This flaw manifests as a classic unsafe deserialization vulnerability (CWE-502) compounded by unauthorized modification of checkpoint data (CWE-913).

Vendors affected include langchain‑ai with the langgraph and langraph‑checkpoint libraries. All releases up to and including version 4.1.0 are vulnerable; the issue is fixed in 4.1.1. Applications that rely on LangGraph SQLite Checkpoint for state persistence should assess whether they are using one of the compromised versions.

The CVSS score of 6.8 indicates a medium‑to‑high severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation is very low in the general population. The flaw is not catalogued in CISA’s KEV list, implying no confirmed exploit activity. However, the vulnerability can only be leveraged if an attacker has the ability to modify checkpoint data at rest, a condition that usually denotes a serious breach or privileged access. Once this precondition is met, the deserialization path can be invoked to execute code within the application process.