Threat · curated 8 Aug 2026
From SQLi to RCE - Exploiting LangGraph’s Checkpointer - Check Point Research
First reported checkpoint.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
AI agent frameworks with tens of millions of downloads carry classic exploitable flaws in their persistence and runtime layers that chain to remote code execution, meaning defenders must patch the plumbing beneath the model, not just guard the prompt.
Check Point researchers Yarden Porat and Shahar Tal disclosed eleven vulnerabilities across six AI agent frameworks (LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google's Agent Development Kit) at Black Hat USA 2026, most being classic bug classes—insecure deserialization, SSRF, path traversal and use-after-free—residing in the runtime rather than the prompt. Two LangGraph checkpointer flaws (SQL injection CVE-2025-67644 and unsafe msgpack deserialization CVE-2026-28277), plus a parallel Redis injection (CVE-2026-27022), chain into remote code execution when applications expose get_state_history() with a user-controlled filter; LangChain patched all three.