LangGraph checkpoint loading has unsafe msgpack deserialization

LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store for example, after a database compromise or other privileged write access to the persistence layer, they can...

CVE-2025-64104 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

MAL-2022-1329 Malicious code in azure-eventhubs-checkpointstore-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 446f07ebe7277743c5b75edd4e41ddee867b36339feabc5d6040ae83fb8c8ea8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...