PT-2025-45384 · Langgraph · Langgraph

Published 2025-11-05 · Updated 2025-12-15 · CVE-2025-64439

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions LangGraph versions 2.1.2 and below

Description LangGraph’s SQLite Checkpoint, which utilizes SQLite databases for checkpoint saving, contains a Remote Code Execution (RCE) issue in the JsonPlusSerializer when deserializing payloads saved in "json" serialization mode. The serializer defaults to "msgpack" but falls back to "json" if Unicode surrogate values cause serialization to fail. This issue allows for arbitrary code execution. The issue is addressed in version 3.0.0.

Recommendations Update to version 3.0.0 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-64439

GHSA-WWQV-P2PP-99H5

Affected Products

Langgraph

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64439.json · Exploit
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-64439 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64439 · Security Note
• https://osv.dev/vulnerability/GHSA-wwqv-p2pp-99h5 · Vendor Advisory
• https://github.com/langchain-ai/langgraph · Note
• https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0 · Note
• https://github.com/langchain-ai/langgraph/blob/c5744f583b11745cd406f3059903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py · Note
• https://github.com/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5 · Note
• https://github.com/langchain-ai/langgraph/commit/c5744f583b11745cd406f3059903e17bbcdcc8ac · Note
• https://reddit.com/r/VulnMatter/comments/1oq8naq/resumen_diario_de_vulnerabilidades_06112025 · Reddit Post
• https://twitter.com/Komodosec/status/2000400310553256033 · Twitter Post
• https://twitter.com/gN3mes1s/status/1986556534642328016 · Twitter Post
• https://t.me/pentestingnews/70739 · Telegram Post
• https://twitter.com/dailytechonx/status/1988310012389662877 · Twitter Post