threat-modeling.com • 8w
Critical RCE Chain in LangGraph via SQLi and Unsafe Deserialization
A critical vulnerability chain in the LangGraph AI framework enables unauthenticated Remote Code Execution (RCE) on self-hosted deployments. The exploit originates from a SQL Injection (SQLi) flaw within the framework’s checkpointer mechanism, specifically affecting SQLite and Redis implementations. By leveraging this SQLi, attackers can manipulate the agent's state to trigger unsafe deserialization of state objects. This allows for arbitrary command execution on the underlying host server. Organizations running self-hosted AI agent orchestration infrastructures that expose state management endpoints to untrusted networks are at immediate risk of full system compromise and unauthorized manipulation of agent logic.