PT-2026-74856

TuxCare rebuilt langgraph-checkpoint to address 1 CVE. Fixed in 2.1.2.post1+tuxcare...

CVE-2026-48121: Improper Neutralization of Special Elements in Data Query Logic

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CLEANSTART-2026-IX44091 Security fixes in py3-langgraph-checkpoint 4.1.1-r0

Package py3-langgraph-checkpoint version 4.1.1-r0 fixes 1 vulnerabilities: ghsa-f4xh-w4cj-qxq8...

CLEANSTART-2026-EY20977 Security fixes in py3-langgraph-prebuilt 1.1.0-r0

Package py3-langgraph-prebuilt version 1.1.0-r0 fixes 2 vulnerabilities: ghsa-f4xh-w4cj-qxq8, ghsa-gr75-jv2w-4656...

PT-2026-85922

Package py3-langgraph-checkpoint version 4.1.1-r0 fixes 1 vulnerabilities: ghsa-f4xh-w4cj-qxq8...

PT-2026-85873

Package py3-langgraph-prebuilt version 1.1.0-r0 fixes 2 vulnerabilities: ghsa-f4xh-w4cj-qxq8, ghsa-gr75-jv2w-4656...

CLEANSTART-2026-QE28556 Security fixes for ghsa-f4xh-w4cj-qxq8, ghsa-gr75-jv2w-4656 applied in versions: 1.1.0-r0

Multiple security vulnerabilities affect the py3-langgraph-prebuilt package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VB75499 Security fixes for ghsa-f4xh-w4cj-qxq8 applied in versions: 4.1.1-r0

Security vulnerability affects the py3-langgraph-checkpoint package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-66790

Security vulnerability affects the py3-langgraph-checkpoint package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-66788

Multiple security vulnerabilities affect the py3-langgraph-prebuilt package. These issues are resolved in later releases. See references for individual vulnerability details...

autonomous-agent (0.0.1), tolstoy-agents (>=0.1.29, <=0.1.49) potentially affected by CVE-2026-48775 via langgraph-checkpoint (1.0.8)

langgraph-checkpoint PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - autonomous-agent 0.0.1 - tolstoy-agents =0.1.29, =0.1.49 Source cves: CVE-2026-48775 Source advisory: OSV:PYSEC-2026-257...

gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (1.0.12)

langgraph-checkpoint PYPI version 1.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =0.3.0, =0.3.5 Source cves: CVE-2026-48775 Source advisory:...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +343 more potentially affected by CVE-2026-48776 via langgraph-sdk (>=0.1.33, <=0.3.14)

langgraph-sdk PYPI version =0.1.33, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-48776 Source advisory: OSV:PYSEC-2026-2575...

kgraphplanner (>=0.0.3, <=0.0.11) potentially affected by CVE-2026-48775 via langgraph-checkpoint (1.0.13)

langgraph-checkpoint PYPI version 1.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner =0.0.3, =0.0.11 Source cves: CVE-2026-48775 Source advisory: OSV:PYSEC-2026-2573...

mafiagg (1.0.4) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.6)

langgraph-checkpoint PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - mafiagg 1.0.4 Source cves: CVE-2026-48775 Source advisory: OSV:PYSEC-2026-2573...

netdata-llm-agent (>=0.3.0, <=0.4.0) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.10)

langgraph-checkpoint PYPI version 2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - netdata-llm-agent =0.3.0, =0.4.0 Source cves: CVE-2026-48775 Source advisory: OSV:PYSEC-2026-2573...

abs-langchain-suite (>=0.2.1, <=0.3.1), adxp-cli (>=0.1.1, <=0.1.21) +147 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (3.0.1)

langgraph-checkpoint PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - abs-langchain-suite =0.2.1, =0.1.1, =0.0.1a1, =2.1.7, =0.0.2, =1.3.9, =0.1.3, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =1.1.0 -...

chainlite (>=0.3.6, <=0.3.7), quivr-modified-milvus (0.1.1) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.1)

langgraph-checkpoint PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - chainlite =0.3.6, =0.3.7 - quivr-modified-milvus 0.1.1 Source cves: CVE-2026-48775 Source advisory: OSV:PYSEC-2026-2573...

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

SummaryLangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in tur...

a2a-client-handler (0.1.0), chemgraph (0.6.0) +7 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.1.0)

langgraph-checkpoint PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - a2a-client-handler 0.1.0 - chemgraph 0.6.0 - chemgraphagent 0.5.0 - coshop =0.1.0, =0.0.12, =0.1.0, =0.0.11, =0.2.1,...