LangGraph Checkpoint versions prior to 3.0.0 contain a remote code execution (RCE) vulnerability in the JsonPlusSerializer when deserializing payloads in the "json" serialization mode. This occurs because the deserializer supports a constructor-style format that can execute arbitrary Python code if malicious payloads are deserialized. The vulnerability is fixed in version 3.0.0 by introducing an allow-list for constructor deserialization and deprecating the unsafe "json" fallback mode. Users of langgraph-api version 0.5 or later are also not affected.