LangGraph Checkpoint Library Hit by Remote Code Execution Flaw

EXECUTIVE SUMMARY:

The remote-code-execution vulnerability identified as CVE-2025-64439 CVSS 7.4 impacts the LangGraph “langgraph-checkpoint” library versions prior to 3.0. It arises from a fallback serialization mechanism in the JsonPlusSerializer component: if serialization using MessagePack fails (for example, when illegal Unicode surrogates are present), the system falls back to JSON mode, where a “constructor” field can reconstruct custom Python objects at deserialization time—allowing an attacker who controls checkpoint data to execute arbitrary Python code in the application’s context.