CVE-2026-48775: 
Python vulnerability analysis and mitigation

CVE-2026-48775 is an unsafe JSON deserialization vulnerability in LangGraph's JsonPlusSerializer, affecting the langgraph-checkpoint package (pip) versions 4.1.0 and prior, as well as langgraph versions prior to 1.2.2. The flaw allows arbitrary Python object reconstruction from JSON checkpoint payloads stored in a backing store (SQLite, PostgreSQL, shared filesystem, etc.), which can result in code execution when those checkpoints are loaded. The vulnerability was first reported by pucagit of CyStack, published as a GitHub Security Advisory on May 22, 2026, and assigned a CVE on June 16, 2026. It carries a CVSS v3.1 base score of 6.8 (Medium/Moderate) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data) and CWE-913 (Improper Control of Dynamically-Managed Code Resources). LangGraph's JsonPlusSerializer — the default serializer for all shipped checkpointer backends including PostgresSaver, SqliteSaver, and their async counterparts — can reconstruct arbitrary Python objects from JSON-encoded checkpoint payloads using a revival path that was not sufficiently restricted. An attacker who has obtained write access to the checkpoint backing store can craft a malicious checkpoint payload; when the LangGraph application subsequently loads or resumes from that checkpoint, the deserialization path reconstructs objects beyond what the application expects, triggering code execution in the worker process. The fix narrows the JSON deserialization revival path to only allow default-constructor reconstruction using args/kwargs from the payload, eliminating the broader object reconstruction capability (Github Advisory, Github Advisory).

Successful exploitation allows an attacker to escalate from "write access to the checkpoint store" to arbitrary code execution within the LangGraph worker process. This can expose runtime secrets (API keys, credentials, environment variables), enable lateral movement to other systems reachable by the runtime, and result in full confidentiality, integrity, and availability compromise of the affected application. The impact is scoped to the worker process and does not inherently cross into other security domains, but the runtime environment of an AI/LLM application may have broad access to sensitive data and downstream services (Github Advisory).

1. Gain write access to the checkpoint store: Obtain unauthorized write access to the SQLite database, PostgreSQL instance, shared filesystem, or other backing store used by the target LangGraph deployment (e.g., via credential theft, misconfigured access controls, or a prior compromise).
2. Identify checkpoint format: Inspect existing checkpoint records in the backing store to understand the JSON payload structure used by JsonPlusSerializer, including the object type encoding and revival fields (args/kwargs/__class__).
3. Craft a malicious checkpoint payload: Construct a JSON checkpoint payload that encodes a Python object whose deserialization triggers arbitrary code execution (e.g., using a gadget chain involving __reduce__-compatible types or other Python object revival mechanisms accepted by the serializer).
4. Write the malicious payload: Insert or overwrite a checkpoint record in the backing store with the crafted payload, targeting a checkpoint ID that the application is expected to load or resume.
5. Trigger checkpoint loading: Wait for or induce the LangGraph application to load or resume from the poisoned checkpoint (e.g., by initiating a workflow that resumes from a saved state).
6. Achieve code execution: The JsonPlusSerializer deserializes the malicious payload, reconstructing the crafted Python object and executing attacker-controlled code within the LangGraph worker process (Github Advisory).

• File System / Database: Unexpected or recently modified checkpoint records in the SQLite database (.db file) or PostgreSQL checkpoint table, particularly records with unusual JSON structures containing unfamiliar __class__ or type revival fields not produced by the application.
• Logs: Application logs showing errors or exceptions during checkpoint deserialization (e.g., unexpected object types, TypeError, or AttributeError during revival); unusual process activity immediately following checkpoint load operations.
• Process: Unexpected child processes spawned by the LangGraph worker process (e.g., shell commands, network utilities like curl, wget, or reverse shell processes); unusual outbound network connections from the worker process.
• Network: Outbound connections to unknown external IPs or domains originating from the LangGraph application server, particularly following checkpoint resume operations.
• Access Logs: Unauthorized or anomalous access to the checkpoint backing store (database audit logs, filesystem access logs) indicating write operations from unexpected users or IP addresses.

Upgrade langgraph-checkpoint to version 4.1.1 or later, and langgraph to version 1.2.2 or later, which narrows the JSON deserialization revival path to prevent arbitrary object reconstruction (Github Advisory). As an operational workaround, treat checkpoint stores as integrity-sensitive: restrict write access to only authorized application service accounts, rotate credentials if unauthorized access is suspected, and implement integrity checks or monitoring on checkpoint data at rest. Avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted. LangSmith-hosted deployments are not believed to be affected, as typical hosted configurations prevent unauthorized access to the checkpoint persistence layer (Github Advisory).

The vulnerability was first reported by pucagit of CyStack security research team and disclosed responsibly through GitHub's security advisory process. The LangGraph maintainers characterized it as a "defense-in-depth" issue and noted no evidence of exploitation in the wild or a practical exploitation path in existing deployments. Red Hat tracked the issue via Bugzilla (Bug 2489358) and assigned it medium severity. No significant broader media coverage or notable community debate has been observed beyond the official advisory channels (Github Advisory, Red Hat Bugzilla).