CVE-2025-64439 json
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
published last yr. modified 4mo ago also EUVD-2025-37934 , GHSA-wwqv-p2pp-99h5 , PYSEC-2026-1527
- cvss
- 7.4
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 2.1.2 and below, the JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a Remote Code Execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode. By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode. This issue is fixed in version 3.0.0.
Patch / fix
- pypi langgraph-checkpoint 3.0.0
- langchain langgraph-checkpoint 3.0.0
Is CVE-2025-64439 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.4 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 7.4 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | langgraph-checkpoint | <3.0.0 |
3.0.0 |
Affected products
- langchain-ai langgraph
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/langchain-ai/langgraph/commit/c5744f583b11745cd406f3059903e17bbcdcc8ac
web
-
github.com
/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5
web
-
github.com
/langchain-ai/langgraph/blob/c5744f583b11745cd406f3059903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/ser
web
-
github.com
/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-64439
advisory
-
github.com
/langchain-ai/langgraph
package
-
pypi.org
/project/langgraph-checkpoint
package
-
github.com
/advisories/GHSA-wwqv-p2pp-99h5
advisory
Sources
- CVE List CVE-2025-64439
- GitHub Advisory GHSA-wwqv-p2pp-99h5
- NVD CVE-2025-64439
- OSV PYSEC-2026-1527
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.