Out-of-Scope Threats
Threats that appear valid in isolation but fall outside project responsibility because they depend on conditions the project does not control.
| Pattern | Why Out of Scope | Project Responsibility Ends At |
|---|---|---|
| Prompt injection leading to arbitrary tool execution | Project does not control LLM model behavior, user prompt construction, or which tools are registered. ToolNode routes by name only to user-registered tools. | Providing tool name allowlist routing
(libs/prebuilt/langgraph/prebuilt/tool_node.py:ToolNode._validate_tool_call);
user owns tool registration and argument handling |
| State poisoning via malicious node output | User-registered nodes (including @task-decorated
functions) can write arbitrary values to channels. The framework
executes nodes as provided. |
Enforcing channel type contracts
(libs/langgraph/langgraph/channels/base.py:BaseChannel.update);
user owns node implementation correctness |
| Cross-session state access via thread_id guessing | Checkpoint savers index by thread_id. Without
application-level auth, any caller with a valid thread_id can access
that thread’s state. |
Providing the Auth handler system for access control
(libs/sdk-py/langgraph_sdk/auth/__init__.py:Auth); user
must implement auth handlers |
| Tool shadowing via duplicate registration | If a user registers two tools with the same name, ToolNode uses the last one. This is user misconfiguration. | Documenting tool registration semantics |
| Indirect prompt injection via tool output | LLM reads tool output and may follow injected instructions. This is a fundamental LLM limitation, not a framework vulnerability. | Not including tool output in system prompts; user owns output handling |
| Model selecting dangerous tool arguments | An LLM may generate SQL injection, path traversal, or command injection payloads as tool arguments. The risk depends entirely on what the user’s tools do with those arguments. | Routing tool calls to registered tools only; user owns tool input validation |
| RCE via user-provided node code | add_node() and
@entrypoint/@task accept arbitrary callables.
A malicious node can do anything. This is by design — the user controls
their own code. |
Executing nodes within the graph runtime; user owns node code safety |
| SSRF via RemoteGraph URL | User provides the url parameter to
RemoteGraph. Pointing it at an internal service is the
user’s decision. |
Documenting that url should be a trusted endpoint; user
owns URL selection |
| Malicious SDK Encryption handler | Encryption handlers are developer-authored server-side code. A malicious handler has full process access, equivalent to any application code. | Validating handler signature (async, param count); handler behavior is the developer’s responsibility |