CVE-2026-27022: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27022 is a RediSearch query injection vulnerability in the @langchain/langgraph-checkpoint-redis npm package affecting versions prior to 1.0.2. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping, allowing low-privileged attackers to bypass thread-based access controls. Disclosed on February 17, 2026, and published to the GitHub Advisory Database on February 18, 2026, it carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74). The list() methods of both RedisSaver and ShallowRedisSaver directly interpolate user-controlled filter keys and values into RediSearch TAG field queries without escaping RediSearch special characters. RediSearch uses | as an OR operator with specific precedence rules (e.g., A B | C is interpreted as (A AND B) OR C), so an attacker can inject a payload such as x}) | (@thread_id:{* into a filter value, producing a query like (@thread_id:{legitimate-thread}) (@source:{x}) | (@thread_id:{*}) that matches all threads due to operator precedence — completely bypassing thread isolation. Exploitation requires only low-privilege access (control over filter input values), which is common in user-facing APIs (GitHub Advisory, LangGraphJS PR).

Successful exploitation allows an authenticated but low-privileged attacker to access checkpoint data from threads they are not authorized to view, resulting in a complete bypass of thread-based access controls. In multi-tenant LangGraph applications using Redis checkpointing, this means sensitive conversation history and state data from other users or tenants can be exfiltrated. There is no integrity or availability impact — the vulnerability is purely a confidentiality breach, but the scope of data exposure can be significant in shared environments (GitHub Advisory, Feedly).

No public exploit code beyond the proof-of-concept included in the official advisory is known, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.032% (6th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only low privileges and no user interaction, making it straightforward to exploit in any application that passes user-controlled input to filter parameters (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a multi-tenant application using @langchain/langgraph-checkpoint-redis versions prior to 1.0.2 that exposes a history or checkpoint listing API endpoint accepting user-controlled filter parameters (e.g., via getStateHistory() or checkpointer.list()).
2. Authenticate as a low-privileged user: Obtain any valid user account or API token for the target application — no elevated privileges are required.
3. Craft a malicious filter payload: Construct a filter value containing RediSearch OR operator syntax designed to escape the current query context and match all threads. Example payload for the source filter key:

{ "source": "x}) | (@thread_id:{*" }

4. Submit the injected filter: Send a request to the API endpoint with the malicious filter value, e.g.:

const stolenHistory = saver.list(
  { configurable: { thread_id: "user-123-thread" } },
  { filter: { source: "x}) | (@thread_id:{*" } }
);

5. Receive cross-tenant data: The resulting RediSearch query (@thread_id:{user-123-thread}) (@source:{x}) | (@thread_id:{*}) matches all threads due to OR operator precedence, returning checkpoint data from all users/tenants in the response (GitHub Advisory, LangGraphJS Advisory).

• Network: Unusual API requests to history/checkpoint listing endpoints with filter parameter values containing RediSearch special characters such as |, {, }, (, ), or @ — particularly patterns like }) | (@thread_id:{*.
• Logs: Application logs showing checkpointer.list() or getStateHistory() calls with filter values containing pipe (|) characters or bracket sequences inconsistent with normal application usage; responses returning unexpectedly large numbers of checkpoint records.
• Application Behavior: A single user session retrieving checkpoint data belonging to other user threads or tenants; anomalous spikes in checkpoint data volume returned per API call compared to baseline.

Upgrade @langchain/langgraph-checkpoint-redis to version 1.0.2 or later, which introduces a new escapeRediSearchTagValue() utility function that properly escapes all RediSearch special characters (- . < > { } [ ] " ' : ; ! @ # $ % ^ & * ( ) + = ~ | \ ? /) in both filter keys and values before query construction. The fix is backward compatible and requires no code changes for most users. As a defense-in-depth measure, even after patching, validate that filter keys are restricted to an explicit allowlist of permitted values in any user-facing API (GitHub Release, LangGraphJS PR).

The vulnerability was discussed on Reddit's r/netsec and r/LangChain communities, with a post titled "PSA: Two LangGraph checkpoint vulnerabilities" drawing attention to this and a related issue. A dev.to article titled "AI/ML Infrastructure Vulnerabilities Expose Systems to Security Risks" covered the broader context of AI/ML infrastructure security, referencing this CVE. Check Point Research also published an advisory (CPAI-2026-4657) covering a vulnerability chain in LangGraph, and media outlets including CXOToday and Express Computer reported on the findings (Reddit r/LangChain, Check Point Advisory).