LangGraph JsonPlusSerializer Deserialization RCE Vulnerability (CVE-2025-49775)

Vulnerability Overview LangGraph's is capable of reconstructing Python objects from JSON checkpoint payloads. In certain scenarios, if an attacker can modify the checkpoint bytes stored in the backend storage, the deserialization process can reconstruct objects beyond what the application expects, potentially leading to code execution when the checkpoint is loaded. This is a defense-in-depth issue, only reachable if checkpoint bytes in the backend storage can be modified by an unauthorized user. In most deployments, the precondition already implies a severe incident, and the additional concern is elevating "write access to checkpoint storage" to "code execution during application runtime." There is currently no evidence that this behavior has been triggered in the wild, nor have actual exploitation paths for existing deployments been identified. This change aims to reduce the attack surface available after a checkpoint storage compromise. Impact Scope Applications using persistent checkpointer (database, remote storage, shared file system, etc.) and using by default. Loading data from checkpoints. Environments where an unauthorized party can obtain write access to the checkpoint storage. The default checkpoint serializer is across all distributed checkpoint backends (PostgresSaver, SqliteSaver, and their asynchronous counterparts); therefore, applications typically do not need to opt-in. Remediation The JSON deserialization path has been restricted so that restoration is limited to reconstruction via the default constructor using the and carried in the payload. The framework's encoder does not rely on the removed behavior to generate checkpoints, so this change does not affect newly written checkpoints due to rollback migration. Old payloads that used the default constructor continue to restore correctly via the same path. Compatibility A narrow legacy regression affects checkpoints for Pydantic models created before October 2025, where the original payload relied on an unvalidated fallback factory to restore incompatible schema evolutions. After this change, such payloads will return , causing failure in the restoration path and falling back to the langchain-core restorer, which will handle the raw dictionary rather than the reconstructed model. Operational Guidance Treat checkpoint storage as integrity-sensitive. If unauthorized access is suspected, restrict write access and rotate credentials. Avoid providing custom JSON restoration hooks unless checkpoint data is fully trusted. LangSmith / Managed Deployment Notes We are unaware of this issue posing a problem for existing LangSmith managed deployments. The described conditions require modification of the checkpoint persistence layer used by the deployment; typical managed configurations are designed to prevent such access. Initial Report Initially reported by pucagit (CyStack). Additional Information CVE ID: CVE-2025-49775 CVSS v3 Base Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Weaknesses: - CWE-502 - CWE-913 Credit: pucagit (Finder) Code Block No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

LangGraph JsonPlusSerializer Deserialization RCE Vulnerability (CVE-2025-49775)

More from this source