Vulnerability in LangGraph SQLite Checkpoint Implementation by LangChain AI
CVE-2026-28277

6.8MEDIUM

Key Information:

Vendor: Langchain-ai
Status: Langgraph
Vendor: CVE Published:; 5 March 2026

🔔 Create Langchain-ai Vulnerability Alert

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-28277?

LangGraph's implementation of SQLite Checkpoint presents a significant security concern. Specifically, versions 1.0.9 and prior are vulnerable to attacks where malicious users can modify checkpoint data stored in the backing store. This manipulation can occur if an attacker gains privileged access to the persistence layer, enabling them to inject crafted payloads. When the compromised checkpoint is loaded, it can result in unsafe Python object reconstruction, leading to potential unauthorized data access or code execution. As of now, no public patch exists to mitigate this threat.