RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
langchain-ailanggraphjs
- Not in CISA KEV
Higher than 45% of scored CVEs
Description NVD
@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls. This vulnerability is fixed in 1.0.2.
Coverage No articles yet
No CyberSIXT article names CVE-2026-27022 yet. New articles appear here and in the RSS feed.