Executive Summary

CVE-2026-48775 is an unsafe JSON deserialization vulnerability in LangGraph's checkpoint loading mechanism. The JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. If an unauthorized party can modify the checkpoint bytes stored in the backing store, the deserialization process might reconstruct objects beyond what the application expects. This can lead to arbitrary code execution when the checkpoint is loaded.

This vulnerability is considered a defense-in-depth issue because it requires the attacker to already have write access to the checkpoint store, which is itself a serious security incident. The vulnerability escalates this access to code execution within the LangGraph worker process.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker who already has write access to the checkpoint store to execute arbitrary code within the LangGraph application runtime. This could lead to exposure of runtime secrets or unauthorized access to other systems accessible by the process.

Because the prerequisite for exploitation is already a serious security breach (write access to checkpoint bytes), the vulnerability primarily escalates the severity of an existing incident by enabling code execution.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises when checkpoint bytes at rest in the backing store have been modified by an unauthorized party. Detection involves verifying the integrity of checkpoint files used by LangGraph SQLite Checkpoint versions 4.1.0 and prior.

Since the vulnerability is related to unsafe JSON deserialization of checkpoint payloads, you should check for any unexpected or unauthorized changes to checkpoint files.

There are no specific commands provided in the available resources to detect this vulnerability directly.

However, general integrity checks on checkpoint files can be performed using file hash verification commands such as:

• On Linux/macOS: `sha256sum <checkpoint_file>` or `md5sum <checkpoint_file>`
• On Windows PowerShell: `Get-FileHash <checkpoint_file> -Algorithm SHA256`

Compare the computed hashes against known good values to detect unauthorized modifications.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade LangGraph SQLite Checkpoint to version 4.1.1 or later, where the issue has been fixed.

Additionally, restrict write access to the checkpoint store to trusted users and processes only, as unauthorized write access is a prerequisite for exploitation.

Avoid using custom JSON revival hooks unless the checkpoint data is fully trusted.

Treat checkpoint stores as integrity-sensitive data and monitor them for unauthorized modifications.

Useful 0 Not Useful 0