LangGraph Checkpoint prior to version 4.0.0 uses a caching mechanism that defaults to JsonPlusSerializer with a pickle fallback. If msgpack serialization fails, cached data is deserialized using pickle.loads, which can lead to remote code execution if an attacker can inject malicious serialized objects into the cache. This requires the application to have caching explicitly enabled and the attacker to have write access to the cache backend, such as a network-accessible Redis instance with weak or no authentication or a writable local cache file. Because exploitation requires prior write access, this vulnerability serves as a post-compromise escalation vector. The issue is resolved in langgraph-checkpoint 4.0.0.

Successful exploitation allows an attacker with write access to the cache backend to execute arbitrary code within the context of the LangGraph process. This can lead to full compromise of the application environment. However, exploitation requires prior access to write attacker-controlled data to the cache, limiting the attack to post-compromise scenarios. Confidentiality, integrity, and availability of the affected system can be fully impacted.

Upgrade langgraph-checkpoint to version 4.0.0 or later, where this vulnerability is patched. If upgrading is not immediately possible, ensure that cache backends are not enabled or that cache storage is not writable by untrusted parties. Restrict write access to cache backends such as Redis instances and local cache files to trusted users and processes only. Patch status is confirmed fixed in version 4.0.0.