6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28277

CVE-2026-28277: LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28277

CVE-2026-28277:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langgraph	pip	<= 1.0.9	1.0.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the unsafe deserialization of msgpack encoded checkpoints in langgraph. The root cause is the _msgpack_ext_hook function in langgraph/checkpoint/serde/jsonplus.py, which was used as the extension hook for the ormsgpack library. This hook performed deserialization without proper validation, allowing an attacker who can control the checkpoint data to craft a payload that leads to arbitrary object reconstruction and potential remote code execution.

The user-facing functions that trigger this vulnerable behavior are JsonPlusSerializer.loads and JsonPlusSerializer.aloads. These methods are responsible for deserializing checkpoint data and, before the patch, they used the insecure _msgpack_ext_hook.

The patch addresses this vulnerability by replacing the insecure _msgpack_ext_hook with a new mechanism that uses an allowlist to control which classes can be deserialized. A new function, _create_msgpack_ext_hook, generates a secure ext_hook that validates types against a set of safe types and a configurable allowlist. The JsonPlusSerializer is modified to use this new secure hook, and the langgraph framework is updated to automatically generate and apply this allowlist when compiling graphs, thus mitigating the risk of arbitrary code execution during checkpoint loading.

Vulnerable functions

JsonPlusSerializer.loads

libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py

This method deserializes data from bytes. Before the patch, it used a vulnerable `msgpack` extension hook (`_msgpack_ext_hook`) that allowed for arbitrary object reconstruction, leading to potential remote code execution if an attacker can control the checkpoint data.

JsonPlusSerializer.aloads

libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py

This method asynchronously deserializes data from bytes. Before the patch, it used a vulnerable `msgpack` extension hook (`_msgpack_ext_hook`) that allowed for arbitrary object reconstruction, leading to potential remote code execution if an attacker can control the checkpoint data.

_msgpack_ext_hook

libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py

This function, which was removed in the patch, was used as the `ext_hook` for `msgpack` deserialization. It directly used `importlib.import_module` and `getattr` to reconstruct objects from the serialized data without any validation, which is the root cause of the deserialization vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.