LangGraph Checkpoint Below 3.0 Allowed Unsafe Deserialization

What changed

LangChain published a security advisory on 5 November 2025 for langgraph checkpoint versions below 3.0. The JsonPlusSerializer could run untrusted Python if an attacker stored a bad payload in json save mode. The bug lives in how checkpoints reload saved state, not in chat text alone.

The fixed release is langgraph checkpoint 3.0.0. That release restricts unsafe constructor loads and deprecates saving in that json mode. Teams must upgrade the library and redeploy workers that load old checkpoints.

Why it matters

Agent apps persist chat state to disk or object stores. If user content can reach checkpoints, load bugs can become remote code run on the host that runs the graph. That is as serious as unsafe pickle loads in older Python apps.

Security teams reviewing AI deploys must treat checkpoint stores like pickle files or plugin caches. A clever prompt is not the only attack path. Poisoned saved state can fire when a worker restarts or when a tenant reloads a session.

Audit teams should add checkpoint save paths to AI threat models this quarter. Auditors may not know LangGraph by name, but they understand code run on shared hosts.

Who is affected

Teams running LangGraph in prod feel this first. Risk rises in multi tenant agents where users upload files or prompts that get checkpointed. Managed langgraph api users on version 0.5 or later are covered by vendor notes in the advisory. Self hosted installs must patch libraries themselves.

Audit staff should add checkpoint save paths to AI threat models this quarter. DevOps must find every service that imports langgraph checkpoint, not only the main API box.

Incident leads should check whether backups replay old checkpoint blobs into patched workers. A patch without blob review can reintroduce risk on restore.

What to do next

Upgrade langgraph checkpoint to 3.0.0 or newer and redeploy workers. Search logs for odd writes to checkpoint backends. Rotate credentials if you suspect attack tries.

Block unauthenticated checkpoint writes at the API layer until patches roll out everywhere. Scan container images for stale pins. Rebuild from lock files that list 3.0.0 or above.

Run a short drill where a fake user uploads a bad checkpoint file. Confirm detection and rollback steps before real attackers try the same path.

What to watch

Watch LangGraph release notes for companion fixes in langgraph api images. Watch whether other save modes get similar allow list hardening.

Track vLLM and NeMo advisories from the same month. Inference and training stacks also saw high severity load bugs in November 2025. Cross team patch days reduce gaps between agent and model serving tiers.

Bug bounty programs may add checkpoint upload scopes after this advisory. Update scope docs so researchers know where to report safely.

Security vendors may ship detections for bad checkpoint blobs. Test those rules on a copy of your store before you enable block mode in prod.

Train support staff to spot users who ask about checkpoint upload errors after patch day. Those tickets can be early signs of probe tries.

Platform teams should pin langgraph checkpoint in a shared internal base image. One pin reduces drift across dozens of microservices.

Legal should store the advisory URL in the vendor risk file for LangChain. Auditors often ask for proof of timely patch during SOC reviews.

Red team leads can add a checkpoint upload case to the next AI agent exercise. Measure mean time to patch across dev, stage, and prod clusters.

SRE on call runbooks should list the exact pip or poetry bump command for langgraph checkpoint. On call engineers move faster with copy paste steps that match your repo.

Product managers should add a release note line for end users if checkpoint format changes after upgrade. Silent format shifts confuse support when old sessions fail to load.

Finance teams rarely line item agent libs, but breach cost from one RCE bug can exceed a year of license fees. Use that frame when you ask for patch sprint time.

Image: GitHub

Photo: Sora Shimazaki / Pexels

Sources

• Primary — GitHub, LangGraph advisory GHSA wwqv p2pp 99h5 (5 November 2025). Describes affected versions and fix in 3.0.0.
• Secondary — GitHub, langgraph checkpoint 3.0.0 release (2025). Patched package tag referenced by the advisory.