CVE-2025-64439 (CVSS 7.4): RCE Flaw Detected in LangGraph: Agent Orchestration Framework at Risk

Estimated reading time: 7 minutes

Key Takeaways:

  • A remote code execution (RCE) vulnerability (CVE-2025-64439) has been discovered in LangGraph.
  • The vulnerability resides in the JsonPlusSerializer component and affects versions prior to 3.0.
  • Upgrading to langgraph-checkpoint version 3.0 or later is crucial to mitigate the risk.
  • Organizations should implement strict input validation and secure serialization practices.
  • PurpleOps offers services to help organizations manage and mitigate cyber threats targeting AI-powered applications.

Table of Contents:

  1. Understanding the Vulnerability
  2. Technical Implications
  3. Mitigation Strategies
  4. Practical Takeaways and Actionable Advice
  5. How PurpleOps Can Help
  6. FAQ

Understanding the Vulnerability

A remote code execution (RCE) vulnerability, identified as CVE-2025-64439 (CVSS 7.4), has been discovered in the LangGraph project, a framework used for building stateful AI agents. This flaw poses a significant risk to applications leveraging LangGraph for persistence, given its widespread use, with 20 million monthly downloads. The vulnerability resides in the JsonPlusSerializer component.

LangGraph is a low-level orchestration framework utilized by tech companies to construct AI agents. The vulnerability, CVE-2025-64439, allows an attacker to execute arbitrary Python code on systems running affected versions of LangGraph. The core of the issue lies in a fallback mechanism within the LangGraph checkpoint serializer.

The system attempts to use MessagePack (msgpack) for serialization by default. However, versions prior to 3.0 would revert to a “json” mode if specific illegal Unicode surrogate values caused serialization to fail. This fallback creates an avenue for exploitation.

If an application using LangGraph accepts untrusted data into its checkpointing system, a malicious actor can craft a payload to execute commands with the privileges of the running process. This scenario enables full remote code execution in environments where LangGraph is integrated into production agents or backend services. The affected component is the JsonPlusSerializer.

The vulnerability impacts all users of the langgraph-checkpoint library in versions earlier than 3.0. However, the risk is most pronounced when:

  • Untrusted or user-supplied data is persisted into checkpoints.
  • The default serializer (or an explicitly instantiated JsonPlusSerializer) is used, which may fall back to “json” mode.

The practical risk is reduced if an application only processes trusted data or prevents untrusted checkpoint writes.

Technical Implications

The vulnerability highlights the dangers of insecure deserialization, particularly when dealing with untrusted data. The fallback to “json” mode, while intended as a resilience measure, inadvertently opens a door for attackers to inject malicious code through carefully crafted payloads. This underscores the importance of strict input validation and secure serialization practices in application development.

The implications of a successful exploit are severe, potentially leading to:

  • Data breaches: Attackers could gain access to sensitive data stored or processed by the AI agents.
  • System compromise: Malicious code execution could allow attackers to take control of the underlying infrastructure.
  • Denial of service: Attackers could disrupt the operation of AI agents, leading to service outages.

Mitigation Strategies

The LangGraph team has addressed the vulnerability in version 3.0 of the langgraph-checkpoint library. Users are urged to upgrade to this version immediately. The patch prevents the deserialization of custom objects saved in the vulnerable “json” mode. Those deploying via langgraph-api are not vulnerable if they are using any version 0.5 or later.

Organizations can also implement additional security measures to mitigate the risk, including:

  • Input validation: Implement strict validation of all data entering the checkpointing system to prevent the injection of malicious payloads.
  • Principle of least privilege: Run AI agents with the minimum necessary privileges to limit the potential impact of a successful attack.
  • Network segmentation: Isolate AI agents from other critical systems to prevent lateral movement by attackers.
  • Monitoring and alerting: Implement monitoring and alerting mechanisms to detect suspicious activity related to the checkpointing system.

Practical Takeaways and Actionable Advice

For Technical Readers:

  1. Immediate Patching: Upgrade to langgraph-checkpoint version 3.0 or later to remediate the vulnerability.
  2. Review Serializers: Examine your LangGraph implementation to ensure you are not using the vulnerable JsonPlusSerializer with untrusted data.
  3. Implement Input Validation: Thoroughly validate all data before it is serialized into checkpoints to prevent malicious payloads.
  4. Secure Configuration: Ensure your LangGraph environment is configured to use secure serialization methods and disable any insecure fallback mechanisms if possible.
  5. Regular Security Audits: Conduct regular security audits of your LangGraph deployments to identify and address potential vulnerabilities.

For Non-Technical Readers (Business Leaders):

  1. Assess Impact: Determine if your organization uses LangGraph in any AI applications and assess the potential impact of this vulnerability on your systems and data.
  2. Communicate with Technical Teams: Ensure your technical teams are aware of CVE-2025-64439 and are taking steps to mitigate the risk.
  3. Prioritize Patching: Allocate resources to prioritize the patching of LangGraph deployments to the latest secure version.
  4. Review Security Practices: Re-evaluate your organization’s security practices related to AI deployments, focusing on data validation and access controls.
  5. Consider Security Expertise: Engage cybersecurity experts to assess your LangGraph deployments and provide guidance on mitigating potential risks.

How PurpleOps Can Help

PurpleOps offers a suite of services to help organizations manage and mitigate cyber threats, including those targeting AI-powered applications. Our capabilities include:

  • Cyber Threat Intelligence Platform: Leverage our cyber threat intelligence platform for real-time ransomware intelligence and proactive monitoring of emerging threats. Understand your attack surface better with continuous monitoring and get relevant alerts through our brand leak alerting service.
  • Breach Detection: Our breach detection services can identify and respond to unauthorized access to your systems, minimizing the impact of a potential attack. Our platform also provides real-time alerts through our telegram threat monitoring service.
  • Supply-Chain Risk Monitoring: We can assess the security posture of your third-party vendors and identify potential vulnerabilities in your supply chain, including those related to open-source components like LangGraph via supply-chain risk monitoring. Understand if your supply chain partners or vendors have been compromised.
  • Dark Web Monitoring Service: Keep an eye on underground forums to detect any mentions of data leaks, exposed credentials, or threat actors targeting your organization. Our dark web monitoring service and underground forum intelligence will detect threats before they cause harm.
  • Red Team Operations & Penetration Testing: Simulate real-world attacks to identify weaknesses in your security defenses and provide actionable recommendations for improvement.

By partnering with PurpleOps, you can strengthen your security posture and protect your organization from the growing threat of cyberattacks.

Contact us today to learn more about how we can help you secure your AI-powered applications and infrastructure. Learn more about our PurpleOps Solutions and our platform.

FAQ

What is CVE-2025-64439? CVE-2025-64439 is a remote code execution vulnerability in LangGraph’s JsonPlusSerializer component.

Which versions of LangGraph are affected? Versions earlier than 3.0 of the langgraph-checkpoint library are affected.

How can I mitigate this vulnerability? Upgrade to langgraph-checkpoint version 3.0 or later and implement strict input validation.

What is insecure deserialization? Insecure deserialization is when an application processes untrusted data that can be manipulated to execute arbitrary code.

How can PurpleOps help? PurpleOps offers services like threat intelligence, breach detection, and supply-chain risk monitoring to protect against cyber threats.