CyberSIXT Search
NVD
6.5 MediumCWE-74
CVE-2026-27022

RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

langchain-ailanggraphjs

Status
  • Not in CISA KEV
Exploit probabilityEPSSchecked 23 Oct
0.6%probability of exploitation in the next 30 days

Higher than 45% of scored CVEs

SeverityCVSS
6.5Medium

Description NVD

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls. This vulnerability is fixed in 1.0.2.

Coverage No articles yet

No CyberSIXT article names CVE-2026-27022 yet. New articles appear here and in the RSS feed.

References

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device