ag-ui-langgraph (>=0.0.1a1, <=0.0.4), copilotkit (>=0.1.52a1, <=0.1.57) +6 more potentially affected by CVE-2026-28277 via langgraph (0.5.0)

langgraph PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ag-ui-langgraph =0.0.1a1, =0.1.52a1, =1.4.0, =0.3.0, =0.1.18, =0.0.1.dev0, =0.1.0a1, =1.2.0, =1.5.0 Source cves: CVE-2026-28277 Source advisor...

enable-ai (>=0.1.0, <=0.4.1), freiburg-ris-ca (0.1.0) +1 more potentially affected by CVE-2026-28277 via langgraph (0.2.31)

langgraph PYPI version 0.2.31 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - enable-ai =0.1.0, =0.4.1 - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

docai-dev (>=0.2.0, <=0.3.0), docailite (>=0.4.0, <=0.6.0) +4 more potentially affected by CVE-2026-28277 via langgraph (0.4.5)

langgraph PYPI version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - docai-dev =0.2.0, =0.4.0, =0.0.19, =0.0.24 - quivr-modified-milvus 0.1.0 - shizheng-mcpdemo-server 0.3.0 Source cves: CVE-2026-28277 Source...

ap-rest-client (>=0.0.6, <=0.0.7), mcp-hybrid-search (>=1.1.2, <=1.1.7) potentially affected by CVE-2026-28277 via langgraph (0.3.11)

langgraph PYPI version 0.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ap-rest-client =0.0.6, =1.1.2, =1.1.7 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

autonomous-agent (0.0.1), kgraphplanner (0.0.2) potentially affected by CVE-2026-28277 via langgraph (0.2.3)

langgraph PYPI version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - autonomous-agent 0.0.1 - kgraphplanner 0.0.2 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

docugami-langchain (>=0.0.7rc1, <=0.0.7rc6) potentially affected by CVE-2026-28277 via langgraph (0.0.24)

langgraph PYPI version 0.0.24 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - docugami-langchain =0.0.7rc1, =0.0.7rc6 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

CVE-2026-28277

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +404 more potentially affected by CVE-2026-28277 via langgraph (>=0.0.15, <=1.0.9)

langgraph PYPI version =0.0.15, =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.0.1, =0.1.1, =0.1.0, =0.0.2, =0.2.0a1, =0.2.0a3 and more Source cves: CVE-2026-28277 Source advisory: MEND:CVE-2026-28277...

CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

CVE-2026-28277

CVE-2026-28277 affects LangGraph checkpoint loading using an SQLite-backed checkpoint store. In versions ≤1.0.9, msgpack-encoded checkpoints may deserialize into Python objects, enabling an attacker with write access to the checkpoint store to craft payloads that trigger unsafe reconstruction whe...

CVE-2026-28277: Deserialization of Untrusted Data

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

langgraph code issue vulnerability

Langgraph is a large-scale model framework developed by LangChain. Versions of Langgraph 1.0.9 and earlier contained code vulnerabilities. These vulnerabilities stemmed from the possibility of re-creating Python objects during deserialization, which could lead to insecure object reconstruction...

LangChain LangGraph BaseCache Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LangChain LangGraph. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BaseCache class. The issue results from the lack of proper validation of...

coze-coding-utils (0.2.0), langchain-timbr (>=2.1.11, <=3.3.0) +1 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (3.0.0)

langgraph-checkpoint PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - coze-coding-utils 0.2.0 - langchain-timbr =2.1.11, =0.3.2, =0.4.1 Source cves: CVE-2026-27794 Source advisory:...

asap-cli (>=0.0.3, <=0.0.4.4), biomni-bridge (>=0.3.1, <=0.3.3) +1 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.1.1)

langgraph-checkpoint PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - asap-cli =0.0.3, =0.3.1, =0.3.3 - quivr-modified-milvus 0.1.0 Source cves: CVE-2026-27794 Source advisory:...

abs-langchain-suite (>=0.1.5, <=0.2.0), actava (0.1.1) +235 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.1.2)

langgraph-checkpoint PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - abs-langchain-suite =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.2.0a1, =0.2.5a2, =0.0.3rc0, =0.8.0, =0.1.2, =0.1.25 -...

netdata-llm-agent (>=0.3.0, <=0.4.0) potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.0.10)

langgraph-checkpoint PYPI version 2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - netdata-llm-agent =0.3.0, =0.4.0 Source cves: CVE-2026-27794 Source advisory: OSV:GHSA-MHR3-J7M5-C7C9...

a2a-client-handler (0.1.0), chemgraph (0.6.0) +7 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.1.0)

langgraph-checkpoint PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - a2a-client-handler 0.1.0 - chemgraph 0.6.0 - chemgraphagent 0.5.0 - coshop =0.1.0, =0.0.12, =0.1.0, =0.0.11, =0.2.1,...