Loading story…
Check Point Research disclosed three vulnerabilities in LangGraph’s persistence layer affecting self-hosted deployments that use SQLite or Redis checkpointers and expose get_state_history() with a user-controlled filter. The most severe attack chain combines a SQL injection flaw in the SQLite checkpointer, tracked as CVE-2025-67644, with unsafe msgpack deserialization, tracked as CVE-2026-28277, allowing an attacker to insert a malicious checkpoint row that is later deserialized into remote code execution. Researchers also identified a SQL injection issue in the Redis checkpointer, CVE-2026-27022, along with additional defense-in-depth SQL injection concerns in SQLite and PostgreSQL query construction.
LangChain released patches and urged users to upgrade to langgraph-checkpoint-sqlite 3.0.1 or later, langgraph 1.0.10 or later, and langgraph-checkpoint-redis 1.0.2 or later. The exposed-risk scenario described in the report applies to self-hosted environments with vulnerable checkpointer configurations, while LangSmith Deployment was reported as unaffected by the primary attack path because it uses PostgreSQL rather than the impacted SQLite or Redis setups.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
LangChain released fixes and advised users to upgrade to langgraph-checkpoint-sqlite 3.0.1 or later, langgraph 1.0.10 or later, and langgraph-checkpoint-redis 1.0.2 or later. The report also stated that LangSmith Deployment, which uses PostgreSQL, was not affected by the primary exposed-risk scenario described.
Check Point Research reported three vulnerabilities in LangGraph’s persistence layer affecting self-hosted deployments that use SQLite or Redis checkpointers when applications expose get_state_history() with a user-controlled filter. The issues included SQL injection flaws in SQLite and Redis paths and an unsafe msgpack deserialization issue that could be chained to achieve remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-25879**, a critical vulnerability in the Langroid Python framework that lets attackers use prompt injection to steer the `SQLChatAgent` component into executing malicious LLM-generated SQL. The flaw can bypass intended input restrictions and abuse database-specific primitives, potentially escalating from SQL manipulation to **remote code execution** on the database host. Reported impacts include arbitrary command execution, data exfiltration, destructive database changes, and possible lateral movement, and the issue was rated **CVSS 9.8**. The exposure affects Langroid versions prior to **0.63.0** and is most severe when the application connects with highly privileged database roles, including capabilities such as PostgreSQL `pg_execute_server_program`, MySQL `FILE`, or MSSQL `xp_cmdshell`. Researchers also warned that exploitation may occur through indirect attacker influence over data returned to the LLM, not only through direct user prompts. Langroid patched the issue in version **0.63.0** by enforcing a strict `SELECT`-only allowlist parsed with `sqlglot` and adding a dialect-aware blocklist for dangerous patterns, while still permitting trusted deployments to restore broader behavior with `allow_dangerous_operations=True`.
Jun 29, 2026
Langroid fixed **CVE-2026-55615** in `Neo4jChatAgent`, where LLM-generated Cypher queries were sent to Neo4j without validation before version `0.65.5`. Because the query text could be influenced by direct user prompts or indirectly through retrieved RAG content, an attacker could abuse prompt-to-Cypher injection to read, modify, or destroy graph data. In Neo4j deployments with dangerous procedures enabled, including **APOC** or `dbms.security` features, the flaw could also expose the filesystem and enable operating system command execution. A related Langroid patch also addressed the same defect pattern in `ArangoChatAgent`, where unvalidated AQL could be passed to the database driver. The remediation introduced a default-off `allow_dangerous_operations` control and validator functions that enforce read-only behavior on retrieval paths while blocking risky primitives such as Neo4j `CALL db.*`, `LOAD CSV`, APOC and `dbms` procedures, and ArangoDB `namespace::func` UDF calls unless explicitly enabled by an operator. The fix was described as mirroring the earlier `SQLChatAgent` bug tracked as **CVE-2026-25879**, and the project added 76 static unit tests to cover attack vectors, enforcement, bypass attempts, and false-positive handling.
Jul 11, 2026
Two critical serialization injection vulnerabilities were discovered in the LangChain framework, which is widely used for building LLM-powered applications. The first vulnerability (CVE-2025-68665) affects the `toJSON()` method in LangChain JS and related serialization routines, where user-controlled data containing the reserved `lc` key could be misinterpreted as legitimate LangChain objects during deserialization. The second vulnerability (CVE-2025-68664) impacts the `dumps()` and `dumpd()` functions, allowing attacker-supplied dictionaries with the `lc` key to be treated as internal objects, potentially leading to the extraction of secrets or the instantiation of internal classes with attacker-defined parameters. Both vulnerabilities are remotely exploitable and have been patched in recent versions of LangChain and LangChain Core. Exploitation of these flaws could allow attackers to extract sensitive information such as environment variables or manipulate application behavior by injecting malicious data structures. Organizations using affected versions of LangChain are strongly advised to upgrade to the patched releases—@langchain/core versions 0.3.80 and 1.1.8, langchain versions 0.3.37 and 1.2.3 for CVE-2025-68665, and langchain-core 0.3.81 and 1.2.5 for CVE-2025-68664—to mitigate the risk of exploitation.
Jun 29, 2026