Deserialization of Untrusted Data

Overview langgraph is a Building stateful, multi-actor applications with LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the msgpack-encoded checkpoints. An attacker can execute arbitrary code by supplying a crafted msgpack-encoded payload to the...

adxp-cli (>=0.1.1, <=0.1.21), agent-builder (>=0.0.2, <=0.1.7) +72 more potentially affected by CVE-2026-28277 via langgraph (>=1.0.0a3, <=1.0.9)

langgraph PYPI version =1.0.0a3, =0.1.1, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =3.0.3, =0.0.2, =0.0.597, =0.1.4, =1.0.0, =0.1.0, =0.1.8, =0.1.92 and more Source cves: CVE-2026-28277 Source advisory: SNYK:PYTHON-LANGGRAPH-15433492...

agent-nexus-cli (>=0.1.0, <=0.1.31) potentially affected by CVE-2026-28277 via langgraph-checkpoint (4.0.0)

langgraph-checkpoint PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - agent-nexus-cli =0.1.0, =0.1.31 Source cves: CVE-2026-28277 Source advisory: SNYK:PYTHON-LANGGRAPHCHECKPOINT-15433491...

lg-agents (>=0.0.11, <=0.0.15), ttyg (1.0.0) potentially affected by CVE-2026-28277 via langgraph (0.4.3)

langgraph PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - lg-agents =0.0.11, =0.0.15 - ttyg 1.0.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

bugbug (0.0.596), langchain-timbr (>=2.1.0, <=2.1.10) potentially affected by CVE-2026-28277 via langgraph (0.6.8)

langgraph PYPI version 0.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - bugbug 0.0.596 - langchain-timbr =2.1.0, =2.1.10 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

coshop (>=0.1.0, <=0.1.1), diagram-to-iac (>=0.8.0, <=1.0.5) +6 more potentially affected by CVE-2026-28277 via langgraph (0.4.8)

langgraph PYPI version 0.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - coshop =0.1.0, =0.8.0, =0.1.0, =0.0.11, =0.0.3, =0.0.10 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ads4gpts-langgraph-agent (>=0.1.1, <=0.1.10), ag-ui-langgraph (0.0.1a0) +60 more potentially affected by CVE-2026-28277 via langgraph (0.3.34)

langgraph PYPI version 0.3.34 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ads4gpts-langgraph-agent =0.1.1, =0.2.0a1, =0.0.3rc0, =0.9.100, =0.1.0a0.dev0, =0.0.0, =0.1.0, =0.10.0, =0.2.3, =0.2.57 and more Source cves:...

ai-parrot (>=0.5.19, <=0.8.2) potentially affected by CVE-2026-28277 via langgraph (0.3.27)

langgraph PYPI version 0.3.27 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ai-parrot =0.5.19, =0.8.2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

synforge (0.1.0) potentially affected by CVE-2026-28277 via langgraph (0.2.74)

langgraph PYPI version 0.2.74 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - synforge 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

cryptocom-agent-client (>=1.0.0, <=1.0.7) potentially affected by CVE-2026-28277 via langgraph (0.2.61)

langgraph PYPI version 0.2.61 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - cryptocom-agent-client =1.0.0, =1.0.7 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

zeitkapsel-api (0.1.0) potentially affected by CVE-2026-28277 via langgraph (0.1.15)

langgraph PYPI version 0.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - zeitkapsel-api 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

stitch-fuzz (0.1.2) potentially affected by CVE-2026-28277 via langgraph (0.2.68)

langgraph PYPI version 0.2.68 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - stitch-fuzz 0.1.2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

actava (0.1.1), actava-cli (0.1.1) +80 more potentially affected by CVE-2026-28277 via langgraph (0.2.76)

langgraph PYPI version 0.2.76 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - actava 0.1.1 - actava-cli 0.1.1 - ads4gpts-langchain =0.1.0, =0.1.1, =0.8.0, =0.1.2, =0.0.45, =0.0.0b1, =1.1.0a20250429, =1.2.0rc4 -...

dialog-lib (>=0.0.1.12, <=0.0.1.18), langchain-postgres (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2026-28277 via langgraph (0.0.32)

langgraph PYPI version 0.0.32 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - dialog-lib =0.0.1.12, =0.0.1, =0.1.3, =0.1.17 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ai-rich (>=0.1.3, <=0.1.5), quorai (>=1.1.0, <=2.2.1) potentially affected by CVE-2026-28277 via langgraph (0.2.56)

langgraph PYPI version 0.2.56 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ai-rich =0.1.3, =1.1.0, =2.2.1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

agentstr-sdk (>=0.6.4, <=0.6.8), chemgraph (0.6.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.4.7)

langgraph PYPI version 0.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - agentstr-sdk =0.6.4, =0.2.0, =0.1.0, =0.1.1, =1.0.0, =0.0.3, =0.1.0a4, =0.1.0a5 Source cves: CVE-2026-28277 Source advisory:...

scrapontologies (0.0.2) potentially affected by CVE-2026-28277 via langgraph (0.2.30)

langgraph PYPI version 0.2.30 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - scrapontologies 0.0.2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

meez (0.2.16) potentially affected by CVE-2026-28277 via langgraph (0.6.0)

langgraph PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - meez 0.2.16 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

langchain-pangu (>=0.1.1, <=0.2.3), tolstoy-agents (>=0.1.29, <=0.1.49) +1 more potentially affected by CVE-2026-28277 via langgraph (0.2.16)

langgraph PYPI version 0.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - langchain-pangu =0.1.1, =0.1.29, =0.2.2, =0.3.5 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

autonomous-agent (0.0.1), kgraphplanner (0.0.2) potentially affected by CVE-2026-28277 via langgraph (0.2.3)

langgraph PYPI version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - autonomous-agent 0.0.1 - kgraphplanner 0.0.2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...