RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

Description

A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package’s filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping.

Recommendation

Update the @langchain/langgraph-checkpoint-redis package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.2
• Patched version(s): 1.0.2

References

• GHSA-5mx2-w598-339m
• CVE-2026-27022
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
• Payload has an SQL Injection via Query Handling - CVE-2026-34747
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• electerm has Command Injection via runLinux funtion - CVE-2026-41501

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@langchain/langgraph-checkpoint-redis