redcoast-orator (0.0.1) potentially affected by CVE-2026-28277 via langgraph (0.2.19)

langgraph PYPI version 0.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - redcoast-orator 0.0.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

aita (>=0.1.3, <=0.1.5), apexgate-langchain (1.0.9) +10 more potentially affected by CVE-2026-28277 via langgraph (0.1.19)

langgraph PYPI version 0.1.19 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - aita =0.1.3, =0.5.0, =0.1.6, =1.2.15, =0.0.1, =0.1.0a1, =1.0.5, =0.0.1, =0.0.11 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-8...

bsrag-langchain (0.3.8.0), codemutator (>=0.0.9, <=0.0.22) +2 more potentially affected by CVE-2026-28277 via langgraph (0.0.51)

langgraph PYPI version 0.0.51 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - bsrag-langchain 0.3.8.0 - codemutator =0.0.9, =0.5.0, =0.5.2 - easyrag 0.0.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

flo-ai (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-28277 via langgraph (0.0.55)

langgraph PYPI version 0.0.55 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - flo-ai =0.0.1, =0.0.3 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

langchain-openai-api-bridge (>=0.1.0, <=0.6.3) potentially affected by CVE-2026-28277 via langgraph (0.0.62)

langgraph PYPI version 0.0.62 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - langchain-openai-api-bridge =0.1.0, =0.6.3 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

PYSEC-2026-83

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

PYSEC-2026-83

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

core4ai (>=1.1.6, <=1.3.1), knowai (0.2.3) potentially affected by CVE-2026-28277 via langgraph (0.3.31)

langgraph PYPI version 0.3.31 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - core4ai =1.1.6, =1.3.1 - knowai 0.2.3 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

kno-sdk (>=1.2.0, <=1.4.10) potentially affected by CVE-2026-28277 via langgraph (0.3.33)

langgraph PYPI version 0.3.33 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - kno-sdk =1.2.0, =1.4.10 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

baicai-base (0.1.2), baicai-tutor (0.1.0) +2 more potentially affected by CVE-2026-28277 via langgraph (0.4.1)

langgraph PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - baicai-base 0.1.2 - baicai-tutor 0.1.0 - botrun-flow-lang =5.5.211, =0.1.0, =0.3.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026...

lg-agents (>=0.0.11, <=0.0.15), ttyg (1.0.0) potentially affected by CVE-2026-28277 via langgraph (0.4.3)

langgraph PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - lg-agents =0.0.11, =0.0.15 - ttyg 1.0.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

agentstr-sdk (>=0.6.4, <=0.6.8), chemgraph (0.6.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.4.7)

langgraph PYPI version 0.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - agentstr-sdk =0.6.4, =0.2.0, =0.1.0, =0.1.1, =1.0.0, =0.0.3, =0.1.0a4, =0.1.0a5 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

droughty (>=0.16.0, <=0.19.0) potentially affected by CVE-2026-28277 via langgraph (0.2.64)

langgraph PYPI version 0.2.64 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - droughty =0.16.0, =0.19.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

graphtomation (0.0.5), lang2sql (>=0.1.0, <=0.1.9) potentially affected by CVE-2026-28277 via langgraph (0.2.62)

langgraph PYPI version 0.2.62 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - graphtomation 0.0.5 - lang2sql =0.1.0, =0.1.9 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

carton-mcp (>=0.1.80, <=0.1.83), cave-harness (0.1.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.2.60)

langgraph PYPI version 0.2.60 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.4.0, =0.1.3, =0.1.0, =0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

kgraphplanner (>=0.0.12, <=0.0.13), mafiagg (1.0.4) potentially affected by CVE-2026-28277 via langgraph (0.2.53)

langgraph PYPI version 0.2.53 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - kgraphplanner =0.0.12, =0.0.13 - mafiagg 1.0.4 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

bugbug (0.0.596), langchain-timbr (>=2.1.0, <=2.1.10) potentially affected by CVE-2026-28277 via langgraph (0.6.8)

langgraph PYPI version 0.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - bugbug 0.0.596 - langchain-timbr =2.1.0, =2.1.10 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

chat-cvdpm (>=0.1.7, <=0.1.13), codeviewx (0.2.8) +2 more potentially affected by CVE-2026-28277 via langgraph (0.6.10)

langgraph PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - chat-cvdpm =0.1.7, =0.1.1, =0.1.7 - iflow-mcp-kerwinmai-multi-agent-exp 2.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

arklex (>=0.0.1, <=0.0.4), chainlite (>=0.3.6, <=0.3.7) potentially affected by CVE-2026-28277 via langgraph (0.2.39)

langgraph PYPI version 0.2.39 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - arklex =0.0.1, =0.3.6, =0.3.7 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

flo-ai (>=0.0.4rc1, <=0.0.6.dev3), quivr-modified-milvus (0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.2.38)

langgraph PYPI version 0.2.38 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - flo-ai =0.0.4rc1, =0.0.6.dev3 - quivr-modified-milvus 0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...