CVE-2025-64439: LangGraph Checkpoint Remote Code Execution Vulnerability in JsonPlusSerializer
Summary
CVE-2025-64439: LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer. Affects langgraph-checkpoint versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LangGraph is an open-source library designed for building and managing stateful graphs in Python applications. It provides functionalities for checkpointing and serialization of graph states. The 'langgraph-checkpoint' package is responsible for saving and loading these states, utilizing various serialization protocols, including JsonPlusSerializer. This package is widely used in applications that require persistent state management, making it crucial for developers to ensure its security.
Vulnerability Detail
Prior to version 3.0 of langgraph-checkpoint, the JsonPlusSerializer contained a remote code execution (RCE) vulnerability when deserializing payloads saved in the 'json' serialization mode. If an attacker can manipulate the application to persist a malicious payload in this mode, they can execute arbitrary Python code during deserialization. This vulnerability arises from the deserializer's support for a constructor-style format for custom objects, which can be exploited if an attacker can trigger this mode with a crafted payload.
How To Fix
Latest published version: 4.3.0 as of 23 Oct 2026
pip install --upgrade "langgraph-checkpoint==4.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
pip install --upgrade "langgraph-checkpoint==3.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the 'json' serialization mode for checkpointing. Ensure that your application only processes trusted data and does not allow untrusted checkpoint writes. Additionally, consider implementing an allow-list for constructor deserialization if you must use custom objects.
Conclusion
The CVE-2025-64439 vulnerability in langgraph-checkpoint poses a significant risk of remote code execution through the JsonPlusSerializer. Users are strongly advised to upgrade to version 3.0.0 or later to mitigate this risk. Implementing best practices for data handling can further enhance security.
See every vulnerability recorded for langgraph-checkpoint →
FAQ
The vulnerability allows remote code execution through the deserialization of malicious payloads in the 'json' serialization mode of JsonPlusSerializer.
All users of langgraph-checkpoint versions earlier than 3.0 who allow untrusted data to be persisted into checkpoints are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, avoid using the 'json' serialization mode and ensure that only trusted data is processed.
The fixed version introduces an allow-list for constructor deserialization and deprecates saving payloads in 'json' format to remove the unsafe fallback path.
References
Related vulnerabilities
Recent vulnerabilities recorded for langgraph-checkpoint.
