51 matches found
CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection
CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL 인젝션 CVE-2025-67644 는 langgraph-checkpoint-sqlite 패키지LangGraph / LangChain 생태계에 속함의 SQL 인젝션 취약점CWE-89입니다. 공격자는 SqliteSaver의 list / alist 메서드에 전달되는 정제되지 않은 메타데이터 필터 키 를 통해 임의의 SQL을 주입할 수 있습니다. 영향 : 필터 완전 우회, 모든 체크포인트 레코드잠재적으로 민감한 대화 상태, 스레드 ID,...
Security Bulletin: Multiple Vulnerabilities in IBM Concert Software
Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-27794 DESCRIPTION: LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in...
CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...
CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...
EUVD-2026-77674
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...
GHSA-533J-2V4Q-MW5H LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...
PT-2026-80768
Name of the Vulnerable Software and Affected Versions langgraph-checkpoint-mongodb versions prior to 0.3.0 langgraph-store-mongodb versions prior to 0.4.0 Description A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. The functions...
PT-2026-80222
Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...
Incorrect Authorization
Overview langgraph-checkpoint-postgres is a Library with a Postgres implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Incorrect Authorization in the search or listnamespaces process. An attacker can access data from unintended namespaces by crafting...
Incorrect Authorization
Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Incorrect Authorization in the search or listnamespaces process. An attacker can access data from unintended namespaces by crafting...
CVE-2026-71433
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...
CVE-2026-71433: Exposure of Sensitive Information to an Unauthorized Actor
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...
PT-2026-68801
Name of the Vulnerable Software and Affected Versions langgraph-checkpoint-postgres versions prior to 3.1.1 langgraph-checkpoint-sqlite versions prior to 3.1.1 Description The Postgres and SQLite implementations of LangGraph's checkpoint saver persist hierarchical namespaces as dot-joined strings...
ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root
Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...
CLSA-2026-1783472544 TuxCare security update for langgraph-checkpoint (1 CVE)
TuxCare rebuilt langgraph-checkpoint to address 1 CVE. Fixed in 2.1.2.post3+tuxcare...
CLSA-2026-1780966309 TuxCare security update for langgraph-checkpoint (1 CVE)
TuxCare rebuilt langgraph-checkpoint to address 1 CVE. Fixed in 2.1.2.post2+tuxcare...
CLSA-2026-1779670109 TuxCare security update for langgraph-checkpoint (1 CVE)
TuxCare rebuilt langgraph-checkpoint to address 1 CVE. Fixed in 2.1.2.post1+tuxcare...
PT-2026-74976
TuxCare rebuilt langgraph-checkpoint to address 1 CVE. Fixed in 2.1.2.post2+tuxcare...
PT-2026-75327
TuxCare rebuilt langgraph-checkpoint to address 1 CVE. Fixed in 2.1.2.post3+tuxcare...
CVE-2026-48121: Improper Neutralization of Special Elements in Data Query Logic
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...