CVE-2026-27022 RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
Attackers can manipulate RediSearch queries via unescaped filter inputs to bypass access controls in LangGraph Redis checkpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27022?
CVE-2026-27022 is a medium-severity vulnerability in langchain-ai langgraphjs, published on 20 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these characters, the query logic can be manipulated to bypass intended access controls. This vulnerability is fixed in 1.0.2.
Weakness: CWE-74
Which versions are affected by CVE-2026-27022?
2 open source packages ship an affected version, including @langchain/langgraph-checkpoint-redis.
| Package | Affected | Fixed in |
|---|---|---|
@langchain/langgraph-checkpoint-redis npm | All versions | 1.0.2 |
@langchain/langgraph-checkpoint-redis npm | All versions | 1.0.2 |
How do I fix CVE-2026-27022?
Upgrade @langchain/langgraph-checkpoint-redis to 1.0.2 or later.
Is CVE-2026-27022 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27022 exists.
Sources
Also known as GHSA-5mx2-w598-339m.