gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-28277 via langgraph (0.2.28)

langgraph PYPI version 0.2.28 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

redcoast-orator (0.0.1) potentially affected by CVE-2026-28277 via langgraph (0.2.19)

langgraph PYPI version 0.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - redcoast-orator 0.0.1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

bsrag-langchain (0.3.8.0), codemutator (>=0.0.9, <=0.0.22) +2 more potentially affected by CVE-2026-28277 via langgraph (0.0.51)

langgraph PYPI version 0.0.51 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - bsrag-langchain 0.3.8.0 - codemutator =0.0.9, =0.5.0, =0.5.2 - easyrag 0.0.1 Source cves: CVE-2026-28277 Source advisory:...

aiagentgraph (>=0.0.1, <=0.0.4a1) potentially affected by CVE-2026-28277 via langgraph (0.0.53)

langgraph PYPI version 0.0.53 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - aiagentgraph =0.0.1, =0.0.4a1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

langchain-openai-api-bridge (>=0.1.0, <=0.6.3) potentially affected by CVE-2026-28277 via langgraph (0.0.62)

langgraph PYPI version 0.0.62 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - langchain-openai-api-bridge =0.1.0, =0.6.3 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

EUVD-2026-9860

LangGraph checkpoint loading has unsafe msgpack deserialization...

GHSA-G48C-2WQR-H844 LangGraph checkpoint loading has unsafe msgpack deserialization

LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store for example, after a database compromise or other privileged write access to the persistence layer, they can...

kno-sdk (>=1.2.0, <=1.4.10) potentially affected by CVE-2026-28277 via langgraph (0.3.33)

langgraph PYPI version 0.3.33 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - kno-sdk =1.2.0, =1.4.10 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ads4gpts-langgraph-agent (>=0.1.1, <=0.1.10), ag-ui-langgraph (0.0.1a0) +60 more potentially affected by CVE-2026-28277 via langgraph (0.3.34)

langgraph PYPI version 0.3.34 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ads4gpts-langgraph-agent =0.1.1, =0.2.0a1, =0.0.3rc0, =0.9.100, =0.1.0a0.dev0, =0.0.0, =0.1.0, =0.10.0, =0.2.3, =0.2.57 and more Source cves:...

docai-dev (>=0.2.0, <=0.3.0), docailite (>=0.4.0, <=0.6.0) +4 more potentially affected by CVE-2026-28277 via langgraph (0.4.5)

langgraph PYPI version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - docai-dev =0.2.0, =0.4.0, =0.0.19, =0.0.24 - quivr-modified-milvus 0.1.0 - shizheng-mcpdemo-server 0.3.0 Source cves: CVE-2026-28277 Source...

droughty (>=0.16.0, <=0.19.0) potentially affected by CVE-2026-28277 via langgraph (0.2.64)

langgraph PYPI version 0.2.64 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - droughty =0.16.0, =0.19.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

graphtomation (0.0.5), lang2sql (>=0.1.0, <=0.1.9) potentially affected by CVE-2026-28277 via langgraph (0.2.62)

langgraph PYPI version 0.2.62 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - graphtomation 0.0.5 - lang2sql =0.1.0, =0.1.9 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

carton-mcp (>=0.1.80, <=0.1.83), cave-harness (0.1.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.2.60)

langgraph PYPI version 0.2.60 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.4.0, =0.1.3, =0.1.0, =0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

raglight (1.4.0) potentially affected by CVE-2026-28277 via langgraph (0.2.59)

langgraph PYPI version 0.2.59 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - raglight 1.4.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

kgraphplanner (>=0.0.12, <=0.0.13), mafiagg (1.0.4) potentially affected by CVE-2026-28277 via langgraph (0.2.53)

langgraph PYPI version 0.2.53 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - kgraphplanner =0.0.12, =0.0.13 - mafiagg 1.0.4 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

bugbug (0.0.595), certora-patrol (>=0.1.3, <=0.1.17) +7 more potentially affected by CVE-2026-28277 via langgraph (0.6.7)

langgraph PYPI version 0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - bugbug 0.0.595 - certora-patrol =0.1.3, =0.1.18, =0.0.2, =0.1.0, =0.1.3, =0.1.4 Source cves: CVE-2026-28277 Source advisory:...

chat-cvdpm (>=0.1.7, <=0.1.13), codeviewx (0.2.8) +2 more potentially affected by CVE-2026-28277 via langgraph (0.6.10)

langgraph PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - chat-cvdpm =0.1.7, =0.1.1, =0.1.7 - iflow-mcp-kerwinmai-multi-agent-exp 2.1.0 Source cves: CVE-2026-28277 Source advisory:...

ai-asset-screener (>=0.1.0, <=0.1.1), meez (>=0.3.0, <=0.3.3) +3 more potentially affected by CVE-2026-28277 via langgraph (0.6.6)

langgraph PYPI version 0.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ai-asset-screener =0.1.0, =0.3.0, =0.1.1a4, =1.6.0, =0.1.0a3, =0.1.2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

arklex (>=0.0.1, <=0.0.4), chainlite (>=0.3.6, <=0.3.7) potentially affected by CVE-2026-28277 via langgraph (0.2.39)

langgraph PYPI version 0.2.39 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - arklex =0.0.1, =0.3.6, =0.3.7 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

a2a-client-handler (0.1.0), diagram-to-iac (1.19.0) +2 more potentially affected by CVE-2026-28277 via langgraph (0.5.1)

langgraph PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - a2a-client-handler 0.1.0 - diagram-to-iac 1.19.0 - meez =0.2.0, =0.2.1, =0.3.2 Source cves: CVE-2026-28277 Source advisory:...