asap-cli (>=0.0.3, <=0.0.4.4), iflow-mcp-prospectio-api-mcp (0.1.0) +2 more potentially affected by CVE-2026-28277 via langgraph (0.6.4)

langgraph PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - asap-cli =0.0.3, =0.2.18, =0.2.21 - structured-sql-agent 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

converso (0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.0.15)

langgraph PYPI version 0.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - converso 0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

abs-langchain-suite (>=0.1.5, <=0.2.0), agentc-langgraph (>=0.2.5a2, <=1.1.0) +18 more potentially affected by CVE-2026-28277 via langgraph (0.5.4)

langgraph PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - abs-langchain-suite =0.1.5, =0.2.5a2, =1.25.1, =1.0.0, =0.1.0a2, =1.0.0b3, =1.3.0, =0.1.1, =0.1.0, =0.1.28a6, =0.2.13, =0.1.17, =0.0.8, =0.2.0...

gpt-verse (0.1.0) potentially affected by CVE-2026-28277 via langgraph (0.0.44)

langgraph PYPI version 0.0.44 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - gpt-verse 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

aita (>=0.1.3, <=0.1.5), apexgate-langchain (1.0.9) +10 more potentially affected by CVE-2026-28277 via langgraph (0.1.19)

langgraph PYPI version 0.1.19 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - aita =0.1.3, =0.5.0, =0.1.6, =1.2.15, =0.0.1, =0.1.0a1, =1.0.5, =0.0.1, =0.0.11 Source cves: CVE-2026-28277 Source advisory:...

ap-rest-client (>=0.0.6, <=0.0.7), mcp-hybrid-search (>=1.1.2, <=1.1.7) potentially affected by CVE-2026-28277 via langgraph (0.3.11)

langgraph PYPI version 0.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ap-rest-client =0.0.6, =1.1.2, =1.1.7 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

meez (>=0.2.9, <=0.2.10), repolaunch (>=1.4.2, <=1.4.3) potentially affected by CVE-2026-28277 via langgraph (0.5.2)

langgraph PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - meez =0.2.9, =1.4.2, =1.4.3 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

myscalekb-agent-base (>=0.0.1, <=0.1.6), originhub-myscalekb-agent-base (>=0.1.8, <=0.2.0) potentially affected by CVE-2026-28277 via langgraph (0.2.35)

langgraph PYPI version 0.2.35 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - myscalekb-agent-base =0.0.1, =0.1.8, =0.2.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

adxp-cli (>=0.1.1, <=0.1.21), agent-builder (>=0.0.2, <=0.1.7) +72 more potentially affected by CVE-2026-28277 via langgraph (>=1.0.0a3, <=1.0.9)

langgraph PYPI version =1.0.0a3, =0.1.1, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =3.0.3, =0.0.2, =0.0.597, =0.1.4, =1.0.0, =0.1.0, =0.1.8, =0.1.92 and more Source cves: CVE-2026-28277 Source advisory: GHSA-G48C-2WQR-H844...

biomni-bridge (>=0.3.1, <=0.3.3), copilotkit (>=0.1.50, <=0.1.52a2) potentially affected by CVE-2026-28277 via langgraph (0.3.18)

langgraph PYPI version 0.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - biomni-bridge =0.3.1, =0.1.50, =0.1.52a2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ag-ui-langgraph (>=0.0.1a1, <=0.0.4), copilotkit (>=0.1.52a1, <=0.1.57) +6 more potentially affected by CVE-2026-28277 via langgraph (0.5.0)

langgraph PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ag-ui-langgraph =0.0.1a1, =0.1.52a1, =1.4.0, =0.3.0, =0.1.18, =0.0.1.dev0, =0.1.0a1, =1.2.0, =1.5.0 Source cves: CVE-2026-28277 Source advisor...

materials-informatics-agent (>=0.1.8, <=0.1.24) potentially affected by CVE-2026-28277 via langgraph (0.3.26)

langgraph PYPI version 0.3.26 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - materials-informatics-agent =0.1.8, =0.1.24 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

pdd-cli (>=0.0.22, <=0.0.25) potentially affected by CVE-2026-28277 via langgraph (0.3.25)

langgraph PYPI version 0.3.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - pdd-cli =0.0.22, =0.0.25 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ai-parrot (>=0.5.0, <=0.5.18), langgraph-prebuilt (0.1.0) potentially affected by CVE-2026-28277 via langgraph (0.3.0)

langgraph PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ai-parrot =0.5.0, =0.5.18 - langgraph-prebuilt 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ai-parrot (>=0.5.19, <=0.8.2) potentially affected by CVE-2026-28277 via langgraph (0.3.27)

langgraph PYPI version 0.3.27 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ai-parrot =0.5.19, =0.8.2 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

agent-lab-sdk (>=0.0.1, <=0.1.16), agentfoundry (1.2.9.1) +17 more potentially affected by CVE-2026-28277 via langgraph (0.4.10)

langgraph PYPI version 0.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - agent-lab-sdk =0.0.1, =0.0.5, =1.0.0b1, =0.70.0, =0.1.53, =1.0.7, =0.2.9, =0.3.11, =0.4.3, =0.1.0, =0.1.0, =1.3.41 and more Source cves:...

algorin-cli (>=0.0.1, <=0.21.0) potentially affected by CVE-2026-28277 via langgraph (0.0.29)

langgraph PYPI version 0.0.29 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - algorin-cli =0.0.1, =0.21.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

flo-ai (>=0.0.4rc1, <=0.0.6.dev3), quivr-modified-milvus (0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.2.38)

langgraph PYPI version 0.2.38 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - flo-ai =0.0.4rc1, =0.0.6.dev3 - quivr-modified-milvus 0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

LangGraph checkpoint loading has unsafe msgpack deserialization

LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store for example, after a database compromise or other privileged write access to the persistence layer, they can...

core4ai (>=1.1.6, <=1.3.1), knowai (0.2.3) potentially affected by CVE-2026-28277 via langgraph (0.3.31)

langgraph PYPI version 0.3.31 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - core4ai =1.1.6, =1.3.1 - knowai 0.2.3 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...