{"id":"CVE-2026-27022","summary":"RediSearch Query Injection in @langchain/langgraph-checkpoint-redis","details":"@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls. This vulnerability is fixed in 1.0.2.","aliases":["GHSA-5mx2-w598-339m"],"modified":"2026-08-12T03:51:40.390794395Z","published":"2026-02-20T21:06:53.773Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-74"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27022.json"},"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langgraphjs/releases/tag/@langchain/langgraph-checkpoint-redis@1.0.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27022.json"},{"type":"ADVISORY","url":"https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-5mx2-w598-339m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27022"},{"type":"FIX","url":"https://github.com/langchain-ai/langgraphjs/commit/814c76dc3938d0f6f7e17ca3bc11d6a12270b2a1"},{"type":"FIX","url":"https://github.com/langchain-ai/langgraphjs/pull/1943"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/langchain-ai/langgraphjs","events":[{"introduced":"0"},{"fixed":"814c76dc3938d0f6f7e17ca3bc11d6a12270b2a1"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.0.2"}]}}],"versions":["@langchain/langgraph@1.1.3","@langchain/langgraph-checkpoint-sqlite@1.0.1","@langchain/langgraph@1.1.2","@langchain/langgraph@1.1.1","@langchain/langgraph-sdk@1.5.5","@langchain/langgraph@1.1.0","@langchain/langgraph-sdk@1.5.4","@langchain/langgraph-sdk@1.5.3","@langchain/langgraph-checkpoint-validation@1.0.9","@langchain/langgraph-sdk@1.5.2","@langchain/langgraph-sdk@1.5.1","@langchain/langgraph@1.0.15","@langchain/langgraph-ui@1.1.11","@langchain/langgraph-sdk@1.5.0","@langchain/langgraph-cli@1.1.11","@langchain/langgraph-api@1.1.11","create-langgraph@1.1.5","@langchain/langgraph@1.0.14","@langchain/langgraph-ui@1.1.10","@langchain/langgraph-sdk@1.4.6","@langchain/langgraph-cli@1.1.10","@langchain/langgraph-checkpoint-validation@1.0.8","@langchain/langgraph-checkpoint-mongodb@1.1.6","@langchain/langgraph-api@1.1.10","create-langgraph@1.1.4","@langchain/langgraph@1.0.13","@langchain/langgraph-ui@1.1.9","@langchain/langgraph-sdk@1.4.5","@langchain/langgraph-cli@1.1.9","@langchain/langgraph-checkpoint-validation@1.0.7","@langchain/langgraph-checkpoint-mongodb@1.1.5","@langchain/langgraph-api@1.1.9","create-langgraph@1.1.3","@langchain/langgraph@1.0.12","@langchain/langgraph-ui@1.1.8","@langchain/langgraph-sdk@1.4.4","@langchain/langgraph-cli@1.1.8","@langchain/langgraph-checkpoint-validation@1.0.6","@langchain/langgraph-checkpoint-mongodb@1.1.4","@langchain/langgraph-api@1.1.8","@langchain/langgraph-ui@0.0.43","@langchain/langgraph-cli@0.0.43","@langchain/langgraph-api@0.0.43","@langchain/langgraph-ui@0.0.42","@langchain/langgraph-cli@0.0.42","@langchain/langgraph-api@0.0.42","@langchain/langgraph-sdk@0.0.90","0.3.6","0.3.1","0.3.0","checkpoint==0.0.18","swarm==0.0.4","supervisor==0.0.13","cua==0.0.6","0.2.74","0.2.73","0.2.68","0.2.65","0.2.64","supervisor==0.0.11","supervisor==0.0.10","0.2.63","swarm==0.0.3","supervisor==0.0.9","0.2.53","0.2.52","swarm==0.0.1","supervisor==0.0.6","supervisor==0.0.5","0.2.44","0.2.37","0.2.31","0.2.30","0.2.26","0.2.24","0.2.22","0.2.21","0.2.18","0.2.17","0.2.15","0.2.12","0.2.11","0.2.10","0.2.9","0.2.8","0.2.7","0.2.6","0.2.4","0.2.3","0.1.5","0.1.1","0.1.0","0.0.29","0.0.28","0.0.22","0.0.8","0.0.7","0.0.6","0.0.5","0.0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27022.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}