From SQLi to RCE Exploiting LangGraph's Checkpointer

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/from-sqli-to-rce-exploiting-langgraphs-checkpointer
• Blog Title: From SQLi to RCE: Exploiting LangGraph's Checkpointer
• Suggested Section: AI Security / AI Models RCE, with cross-references from Pentesting Web > SQL Injection and Pentesting Web > Deserialization

🎯 Content Summary

Check Point Research disclosed a critical LangGraph persistence-layer attack chain that turns SQL injection into remote code execution. LangGraph is an open-source framework for building stateful, multi-agent AI systems with built-in persistence, reportedly with more than 50 million monthly downloads according to PyPI statistics. Its persistence layer is implemented through checkpointers, which store execution state at each step so an AI agent c...

🔧 Technical Details

Filter-key SQL injection through JSON path construction: when an application accepts a dictionary from users and uses dictionary keys to build SQL JSON paths, parameterizing only the values is insufficient. The dangerous pattern is json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}, where query_key is attacker-controlled. A single quote can escape the JSON path string and inject SQL. The generalized lesson is to validate structural query components, including JSON paths, column names, operators, LIMIT, and TTL clauses, against strict allowlists or encode them safely; they cannot be protected by value binding alone.

Turning SQL injection into deserialization with injected result rows: SQL injection can be used to control downstream application behavior, not only read database data. If query results are later passed to a parser, deserializer, template renderer, file writer, or command sink, an...

🤖 Agent Actions

Using repo inspection to find the best existing page, likely under AI plus a page that already covers unsafe deserialization or agent attack surfaces.
Done — I updated src/AI/AI-Models-RCE.md.

Added:

• a new LangGraph entry in the RCE overview table
• a concise section on:
  • filter-key / JSON-path SQLi
  • UNION SELECT fake-row deserialization
  • unsafe MessagePack extension hooks
  • AI-agent persistence/checkpointer audit points
• the Check Point blog in ## References

I kept everything in a single file as requested.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/from-sqli-to-rce-exploiting-langgraphs-checkpointer

Content Categories: Based on the analysis, this content was categorized under "AI Security / AI Models RCE, with cross-references from Pentesting Web > SQL Injection and Pentesting Web > Deserialization".

Repository Maintenance:

• MD Files Formatting: 977 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0