Remote Code Execution Vulnerability in LangGraph Checkpoint by LangChain AI

CVE-2026-27794

What is CVE-2026-27794?

A Remote Code Execution vulnerability has been identified in the caching layer of LangGraph Checkpoint prior to version 4.0.0. When applications enable specific caching mechanisms that utilize BaseCache, which defaults to using JsonPlusSerializer(pickle_fallback=True), it may allow the execution of arbitrary code. This occurs if msgpack serialization fails and leads to unsafe deserialization via pickle.loads(...). For exploitation to occur, an attacker needs write access to a cache backend that could be a vulnerable Redis instance or a writable SQLite cache. The issue underscores the importance of careful configuration of caching solutions to prevent unauthorized access and potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References