LangGraph Deserialization Flaw Enables Execution of Malicious Python Code

A critical remote code execution vulnerability has been revealed in LangGraph’s checkpoint serialization library, affecting versions before 3.0. The flaw sits in the JsonPlusSerializer, the default serialization protocol for checkpointing, and enables attackers to execute arbitrary Python code during deserialization of malicious payloads (CVE-2025-64439).

Details from the advisory note that LangGraph-classified vulnerability is a Remote Code Execution risk with a Network attack vector and Low privileges required, and it targets langgraph-checkpoint versions earlier than 3.0, with a patch available in langgraph-checkpoint 3.0.0.

The weakness stems from an unsafe fallback mechanism: when illegal Unicode surrogate values block serialization, the system falls back to json mode, which under deserialization can reconstruct custom objects and potentially run commands or arbitrary functions. LangGraph advises upgrading immediately to langgraph-checkpoint version 3.0.0 and updating LangGraph API to version 0.5 or later, mentioning that the patch introduces an allowlist for constructor deserialization and deprecates saving payloads in json format.

The advisory is documented according to GHSA-wwqv-p2pp-99h5, and a remediation is provided by LangGraph’s maintainers, with no required code changes for deployment.