# GHSA-wwqv-p2pp-99h5: LangGraph Checkpoint RCE via JsonPlusSerializer

## Description

### Summary
A remote code execution vulnerability exists in LangGraph's checkpoint library (langgraph-checkpoint) via the JsonPlusSerializer. The serializer's JSON mode supports a constructor-style format that enables arbitrary code execution during deserialization.

### Impact
An attacker who can persist untrusted data into checkpoints can execute arbitrary code when the checkpoint is deserialized. The attack works by crafting a payload with `"lc": 2` and `"type": "constructor"` containing arbitrary module/class paths (e.g., `os.system`).

## Vulnerability Details

- **Advisory**: GHSA-wwqv-p2pp-99h5
- **CVE**: CVE-2025-64439
- **CWE**: CWE-502 (Deserialization of Untrusted Data)
- **CVSS Score**: 7.4 (High)
- **Package**: langgraph-checkpoint
- **Ecosystem**: pip
- **Affected Versions**: < 3.0.0
- **Fixed Version**: 3.0.0

## Technical Details

The JsonPlusSerializer in LangGraph's checkpoint library has two modes:
1. **msgpack mode** (default) - Binary serialization
2. **json mode** - Falls back when msgpack fails (e.g., illegal Unicode surrogates)

In JSON mode, the deserializer processes objects with special markers:
- `"lc": 2` indicates a constructor-type object
- `"type": "constructor"` triggers custom object reconstruction
- `"id"` specifies the module path and class to instantiate
- `"args"` contains arguments passed to the constructor

An attacker can craft a payload like:
```json
{
  "lc": 2,
  "type": "constructor", 
  "id": ["os", "system"],
  "args": ["touch /tmp/pwned"]
}
```

When this payload is deserialized, it calls `os.system("touch /tmp/pwned")`.

## References

- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5
- https://nvd.nist.gov/vuln/detail/CVE-2025-64439