Threats

ID Data Flow Classification Threat Boundary Severity Validation Code Reference
T1 DF1, DF11 DC3 Arbitrary code execution via msgpack deserialization when strict mode is OFF (default) TB2 High Verified libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:_create_msgpack_ext_hook
T2 DF1 DC3 Arbitrary code execution via pickle.loads when pickle_fallback=True TB2 High Verified libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:JsonPlusSerializer.loads_typed
T3 DF1 DC3 Arbitrary module import/execution via JSON lc:2 constructor when allowed_json_modules=True TB2 High Verified libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:JsonPlusSerializer._revive_lc2
T4 DF5 Unvalidated dict-splatting from remote API into Interrupt/Command objects TB3 Medium Likely libs/langgraph/langgraph/pregel/remote.py:RemoteGraph.stream
T5 DF6, DF7 Dockerfile ENV injection via single-quote in langgraph.json config values TB4 Low Likely libs/cli/langgraph_cli/config.py:python_config_to_docker
T6 DF7 ZIP slip in langgraph new template extraction TB4 Low Unverified libs/cli/langgraph_cli/templates.py:_download_repo_with_requests
T7 DF10 DC2 AES key entropy limited to printable characters via env var string encoding TB2 Info libs/checkpoint/langgraph/checkpoint/serde/encrypted.py:EncryptedSerializer.from_pycryptodome_aes
T8 DF10 DC2 EncryptedSerializer cipher name check uses assert (stripped with python -O) TB2 Low Verified libs/checkpoint/langgraph/checkpoint/serde/encrypted.py:PycryptodomeAesCipher.decrypt
T9 DF12, DF13 DC1 SDK API key leak via server-controlled Location redirect to attacker-controlled URL TB3 Medium Verified libs/sdk-py/langgraph_sdk/_async/http.py:HttpClient.request_reconnect, libs/sdk-py/langgraph_sdk/_async/http.py:HttpClient.stream
T10 DF1 DC3 EncryptedSerializer silently accepts unencrypted data — attacker bypasses encryption by writing plain type tags TB2 Medium Verified libs/checkpoint/langgraph/checkpoint/serde/encrypted.py:EncryptedSerializer.loads_typed
T11 DF1, DF11 DC3, DC6 Unbounded retention of checkpoint data containing PII/conversation history TB2 Medium libs/checkpoint/langgraph/checkpoint/base/__init__.py:BaseCheckpointSaver