Description

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls. This vulnerability is fixed in 1.0.2.

INFO

Published Date :

2026-02-20T21:06:53.773Z

Last Modified :

2026-02-24T18:33:25.127Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-27022 vulnerability.

Vendors Products
Langchain-ai
  • Langgraphjs
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27022.

URL Resource
https://github.com/langchain-ai/langgraphjs/commit/814c76dc3938d0f6f7e17ca3bc11d6a12270b2a1 cve-icon cve-icon
https://github.com/langchain-ai/langgraphjs/pull/1943 cve-icon cve-icon
https://github.com/langchain-ai/langgraphjs/releases/tag/@langchain/[email protected] cve-icon cve-icon
https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-5mx2-w598-339m cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact