| T1 |
DF1, DF11 |
DC3 |
Arbitrary code execution via msgpack deserialization when strict
mode is OFF (default) |
TB2 |
High |
Verified |
libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:_create_msgpack_ext_hook |
| T2 |
DF1 |
DC3 |
Arbitrary code execution via pickle.loads when
pickle_fallback=True |
TB2 |
High |
Verified |
libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:JsonPlusSerializer.loads_typed |
| T3 |
DF1 |
DC3 |
Arbitrary module import/execution via JSON lc:2
constructor when allowed_json_modules=True |
TB2 |
High |
Verified |
libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py:JsonPlusSerializer._revive_lc2 |
| T4 |
DF5 |
— |
Unvalidated dict-splatting from remote API into
Interrupt/Command objects |
TB3 |
Medium |
Likely |
libs/langgraph/langgraph/pregel/remote.py:RemoteGraph.stream |
| T5 |
DF6, DF7 |
— |
Dockerfile ENV injection via single-quote in
langgraph.json config values |
TB4 |
Low |
Likely |
libs/cli/langgraph_cli/config.py:python_config_to_docker |
| T6 |
DF7 |
— |
ZIP slip in langgraph new template extraction |
TB4 |
Low |
Unverified |
libs/cli/langgraph_cli/templates.py:_download_repo_with_requests |
| T7 |
DF10 |
DC2 |
AES key entropy limited to printable characters via env var string
encoding |
TB2 |
Info |
— |
libs/checkpoint/langgraph/checkpoint/serde/encrypted.py:EncryptedSerializer.from_pycryptodome_aes |
| T8 |
DF10 |
DC2 |
EncryptedSerializer cipher name check uses assert
(stripped with python -O) |
TB2 |
Low |
Verified |
libs/checkpoint/langgraph/checkpoint/serde/encrypted.py:PycryptodomeAesCipher.decrypt |
| T9 |
DF12, DF13 |
DC1 |
SDK API key leak via server-controlled Location redirect to
attacker-controlled URL |
TB3 |
Medium |
Verified |
libs/sdk-py/langgraph_sdk/_async/http.py:HttpClient.request_reconnect,
libs/sdk-py/langgraph_sdk/_async/http.py:HttpClient.stream |
| T10 |
DF1 |
DC3 |
EncryptedSerializer silently accepts unencrypted data — attacker
bypasses encryption by writing plain type tags |
TB2 |
Medium |
Verified |
libs/checkpoint/langgraph/checkpoint/serde/encrypted.py:EncryptedSerializer.loads_typed |
| T11 |
DF1, DF11 |
DC3, DC6 |
Unbounded retention of checkpoint data containing PII/conversation
history |
TB2 |
Medium |
— |
libs/checkpoint/langgraph/checkpoint/base/__init__.py:BaseCheckpointSaver |