LangGraph's checkpointer component, which provides persistence for AI agent execution state, is vulnerable to SQL injection that can be leveraged to achieve remote code execution. This vulnerability arises from insufficient access controls or input validation in the persistence layer. The exploit chain starts with SQLi and escalates to RCE, potentially allowing attackers to execute arbitrary code on affected systems. The affected versions include those before 3.0.1, 1.0.10, and 1.0.2. No known exploits in the wild have been reported as of the publication date. The vulnerability was disclosed by Check Point Research in a detailed technical article.

Successful exploitation can lead to remote code execution on systems running vulnerable versions of LangGraph, potentially compromising the host environment and any AI agents relying on the framework's persistence. This could allow attackers to manipulate AI agent behavior, access sensitive data, or disrupt operations dependent on LangGraph. The medium severity reflects the significant impact of RCE balanced against the lack of reported active exploitation and unknown patch status.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the persistence layer, applying input validation controls, and monitoring for suspicious activity related to LangGraph checkpointer usage. Follow updates from the LangGraph maintainers and Check Point Research for official patches or mitigations.