CVE-2026-48775: LangGraph SQLite Checkpoint RCE Flaw

CVE-2026-48775 Overview

CVE-2026-48775 is an insecure deserialization vulnerability in the LangGraph SQLite Checkpoint library, an implementation of LangGraph CheckpointSaver that persists state to SQLite (synchronous and asynchronous via aiosqlite). The flaw resides in the JsonPlusSerializer, which reconstructs Python objects from JSON checkpoint payloads. An attacker with write access to checkpoint bytes at rest can craft a payload that triggers object reconstruction beyond the application's expected types. This deserialization path can lead to code execution when the checkpoint is loaded. The issue affects versions 4.1.0 and prior and is fixed in version 4.1.1. The maintainers classify this as a defense-in-depth issue because exploitation requires prior unauthorized write access to the backing store. The vulnerability is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
An attacker with write access to the SQLite checkpoint store can achieve code execution in the LangGraph application runtime when a tampered checkpoint is loaded.

Affected Products

LangGraph SQLite Checkpoint versions 4.1.0 and prior
LangGraph deployments using JsonPlusSerializer with SQLite backing store
LangGraph deployments using aiosqlite async checkpoint persistence

Discovery Timeline

2026-06-16 - CVE-2026-48775 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48775

Vulnerability Analysis

LangGraph uses checkpoints to persist graph execution state between runs. The SQLite Checkpoint implementation serializes state objects to JSON-encoded bytes and stores them in a SQLite database. On load, the JsonPlusSerializer deserializes those bytes back into Python objects.

The serializer supports reconstruction of arbitrary Python objects encoded in the JSON payload. When the deserializer processes a crafted payload, it can instantiate object types the application never expected to see at that location. This object reconstruction path provides the primitives required to invoke code during load. The result is code execution in the application runtime when a poisoned checkpoint is read.

The maintainers describe the issue as defense-in-depth because reaching the vulnerable code path requires write access to the SQLite store. In most deployments, that access already implies a serious incident. The vulnerability converts that store-write primitive into runtime code execution.

Root Cause

The root cause is unsafe deserialization in JsonPlusSerializer [CWE-502]. The serializer accepts type metadata embedded in checkpoint payloads and reconstructs the referenced Python objects without restricting the set of permitted classes. Trusting checkpoint bytes at rest is the design assumption that fails when an attacker can modify those bytes.

Attack Vector

The attack requires an attacker to modify checkpoint records in the SQLite database used by the LangGraph application. The attacker writes a malicious serialized payload into the checkpoint row for a graph thread. When the application next loads that checkpoint, JsonPlusSerializer reconstructs the attacker-controlled object graph and executes code in the process context of the LangGraph runtime. The attack vector is local to the database backing store, which aligns with the adjacent-network access requirement and high privilege prerequisite reflected in the scoring vector.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-fjqc-hq36-qh5p for vendor technical details.

Detection Methods for CVE-2026-48775

Indicators of Compromise

Unexpected writes or schema modifications to SQLite checkpoint files outside of the LangGraph application process
Checkpoint rows containing serialized type references to classes not used by the application (for example, subprocess, os.system, or pickle reducer constructs)
LangGraph worker processes spawning child processes or making outbound network connections immediately after checkpoint load

Detection Strategies

Hash and baseline checkpoint payload structures, then alert on records whose serialized type tags fall outside the application's known schema
Monitor file integrity of the SQLite database files backing SqliteSaver and AsyncSqliteSaver for modifications outside the application process
Audit access logs for the host filesystem or storage volume that contains the checkpoint database

Monitoring Recommendations

Log and review LangGraph checkpoint load events and correlate them with process-level child process creation and network egress
Enable database-level audit logging for any SQLite share or network mount that hosts the checkpoint store
Track upgrades of the langgraph-checkpoint-sqlite package across environments to confirm versions at or above 4.1.1

How to Mitigate CVE-2026-48775

Immediate Actions Required

Upgrade langgraph-checkpoint-sqlite to version 4.1.1 or later in all environments using LangGraph with SQLite checkpoints
Restrict filesystem and network access to the SQLite checkpoint database so only the LangGraph application process can write to it
Review existing checkpoint records for unexpected serialized types and purge or quarantine suspicious entries before upgrading

Patch Information

The maintainers fixed the issue in langgraph-checkpoint-sqlite version 4.1.1. The patch constrains the deserialization path so that JsonPlusSerializer no longer reconstructs arbitrary Python objects from checkpoint payloads. Refer to the GitHub Security Advisory GHSA-fjqc-hq36-qh5p for full remediation guidance.

Workarounds

Store the checkpoint SQLite database on a volume that is not writable by any user or service other than the LangGraph runtime
Use full-disk or per-file encryption with integrity protection on the checkpoint store to detect tampering at rest
If upgrading is not immediately possible, replace JsonPlusSerializer with a custom serializer that rejects type metadata and only accepts primitive JSON values

bash

# Upgrade to the patched release
pip install --upgrade 'langgraph-checkpoint-sqlite>=4.1.1'

# Verify the installed version
pip show langgraph-checkpoint-sqlite | grep -i version