Reviewing LangChain and LangGraph agents — the serialization and checkpoint attack surface

LangChain provides the agent-facing abstractions: model connectors, tool integrations, and the loop that lets a model reason about a task, call tools, and act on results iteratively. LangGraph sits underneath as the orchestration runtime for anything that needs to be a graph rather than a single loop — multi-step workflows with branching, state that has to survive a process restart, or a point where a human needs to review and approve before the agent continues.

For a review, the practical distinction is this: LangChain-only agents have a smaller, simpler surface (mostly tool-calling). The moment LangGraph's checkpointing is in the picture, agent state itself becomes a persisted, queryable artifact — which is exactly where one of the three CVEs below lives.

A coordinated disclosure in early 2026 identified multiple high-and-critical-severity issues across LangChain and LangGraph. Three are worth walking through individually, because each one maps to a distinct review question:

The common thread isn't a coding mistake in any one function — it's that a convenience feature (auto-serialization, a path-based loader, a persisted checkpoint store) was built assuming the input feeding it was trusted, in a framework whose whole purpose is running on model-generated and model-influenced input.

The three CVEs above all live in the framework code itself. A fourth, disclosed by Noma Security and dubbed “AgentSmith” (CVSS 8.8), lived somewhere different: LangChain Hub's public Prompt Hub, where anyone can publish and share agent configurations. An attacker could upload an agent with a malicious proxy configuration baked in; once another user adopted that shared agent, the proxy silently intercepted all of its traffic — API keys (OpenAI keys included), prompts, uploaded documents, images, and voice input, with the added capability to tamper with the model's responses in transit. LangChain patched it within eight days of disclosure, scoped specifically to the Prompt Hub's public-sharing feature.

None of the three CVEs above requires unusual access on its own — each is reachable through ordinary agent operation: an agent that reads untrusted content (a webpage, a document, a tool result) and later produces structured output, an agent that loads a prompt template by a name or path the application passes through, or an agent whose execution state is checkpointed to a shared database. In a production deployment, prompt injection into the serialization path and SQL injection into the checkpoint store can chain into a single sequence: inject a payload through content the agent reads, have it steer the agent's structured output, deserialize into code execution, then use that access against the checkpoint database or filesystem directly.

The review implication is specific: patch versions close the individual CVEs, but the pattern — untrusted content flowing into serialization, path resolution, or query construction without an explicit trust check — can recur in application code built on top of these frameworks even after the framework itself is patched. A review has to check the application's own use of these APIs, not just the installed package version.

To LangChain's credit, the 1.0 release doesn't leave guardrails as an afterthought the way some competitors in this cluster do — they ship as built-in middleware. A PII-detection middleware catches emails, credit cards, IP addresses, and Social Security numbers before they propagate; a HumanInTheLoopMiddleware intercepts tool calls and lets a human approve, edit, or reject before execution, with per-tool granularity so routine tools run automatically while higher-risk ones always pause.

LangSmith's observability layer takes a similarly layered approach to trace data: a client-side anonymizer strips PII before a trace is even serialized, a newer LangSmith LLM Gateway redacts sensitive data from requests and responses before they reach the model or get written to a trace at all, and the platform supports plugging in Microsoft Presidio or Amazon Comprehend for more advanced detection. None of this retroactively closes the four issues above — it's a separate, additive control layer, and a review should confirm it's actually turned on for a given deployment rather than assuming it ships enabled by default.

For any system built on LangChain and/or LangGraph, a design-time review should be able to answer:

• Is langchain-core, langgraph-checkpoint, and any checkpoint-store adapter pinned to a version that post-dates the three CVEs above?
• Does any code path deserialize model-generated structured output without validating it against an expected schema first?
• Does the prompt-loading or template-loading API ever receive a path or name derived from user or model input, rather than a fixed, developer-controlled value?
• Is the checkpoint store (SQLite or otherwise) constructed from parameterized queries, and is metadata used in filters treated as untrusted?
• If checkpoints are shared across users or tenants, is there a boundary preventing one tenant's agent from reading or corrupting another's checkpoint state?
• If any agent or prompt template was adopted from LangChain Hub's public Prompt Hub, has its proxy/tool configuration been reviewed the same way a third-party MCP server would be?
• Is LangSmith's PII-redaction middleware or LLM Gateway actually enabled for this deployment, or left at platform defaults?

See the general AI security review checklist for the framework-agnostic version of this list, and tool-use permission scoping for the broader pattern behind the path-traversal and SSRF-shaped issues that show up across most agent frameworks, not just this one.