mafiagg (1.0.4) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.6)

langgraph-checkpoint PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - mafiagg 1.0.4 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

Deserialization of Untrusted Data

Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonPlusSerializer deserialization process of payloads saved in the json serialization mode. ...

gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2025-64439 via langgraph-checkpoint (1.0.12)

langgraph-checkpoint PYPI version 1.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =0.3.0, =0.3.5 Source cves: CVE-2025-64439 Source advisory:...

kgraphplanner (>=0.0.12, <=0.0.13) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.7)

langgraph-checkpoint PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner =0.0.12, =0.0.13 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

mcp-hybrid-search (>=1.1.2, <=1.1.7) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.20)

langgraph-checkpoint PYPI version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - mcp-hybrid-search =1.1.2, =1.1.7 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

kgraphplanner (>=0.0.3, <=0.0.11) potentially affected by CVE-2025-64439 via langgraph-checkpoint (1.0.13)

langgraph-checkpoint PYPI version 1.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner =0.0.3, =0.0.11 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

kgraphplanner (0.0.2) potentially affected by CVE-2025-64439 via langgraph-checkpoint (1.0.2)

langgraph-checkpoint PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner 0.0.2 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

netdata-llm-agent (>=0.3.0, <=0.4.0) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.10)

langgraph-checkpoint PYPI version 2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - netdata-llm-agent =0.3.0, =0.4.0 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

agentiacap (>=0.1.31, <=0.1.37) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.16)

langgraph-checkpoint PYPI version 2.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - agentiacap =0.1.31, =0.1.37 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

baicai-base (0.1.2), baicai-tutor (0.1.0) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.25)

langgraph-checkpoint PYPI version 2.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - baicai-base 0.1.2 - baicai-tutor 0.1.0 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-99H5...

a2a-client-handler (0.1.0), chemgraph (0.6.0) +7 more potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.1.0)

langgraph-checkpoint PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - a2a-client-handler 0.1.0 - chemgraph 0.6.0 - chemgraphagent 0.5.0 - coshop =0.1.0, =0.0.12, =0.1.0, =0.0.11, =0.2.1,...

asap-cli (>=0.0.3, <=0.0.4.4), biomni-bridge (>=0.3.1, <=0.3.3) +1 more potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.1.1)

langgraph-checkpoint PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - asap-cli =0.0.3, =0.3.1, =0.3.3 - quivr-modified-milvus 0.1.0 Source cves: CVE-2025-64439 Source advisory:...

abs-langchain-suite (>=0.1.5, <=0.2.0), actava (0.1.1) +235 more potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.1.2)

langgraph-checkpoint PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - abs-langchain-suite =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.2.0a1, =0.2.5a2, =0.0.3rc0, =0.8.0, =0.1.2, =0.1.25 -...

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

Summary Prior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer used as the default serialization protocol for all checkpointing contains a remote code execution RCE vulnerability when deserializing payloads saved in the "json" serialization mode. If an attacker can cause your...

Deserialization of Untrusted Data

Overview langgraph is a Building stateful, multi-actor applications with LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonPlusSerializer deserialization process of payloads saved in the json serialization mode. An attacker can execute arbitrar...

brickllm (>=1.0.0, <=1.3.0), dm-aioaiagent (>=0.1.0, <=0.3.0) +11 more potentially affected by CVE-2025-64439 via langgraph-checkpoint (1.0.14)

langgraph-checkpoint PYPI version 1.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - brickllm =1.0.0, =0.1.0, =0.1.0, =0.1.1, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =0.2.2, =0.2.3 Source cves: CVE-2025-64439...

deepagents (0.0.12rc3), gradient-adk (>=0.0.3, <=0.1.9) +3 more potentially affected by CVE-2025-64439 via langgraph (>=1.0.0a3, <=1.0.0)

langgraph PYPI version =1.0.0a3, =0.0.3, =0.1.9 - langchain 1.0.0a10 - novachain 0.1.0 - tai-chat 0.2.1 Source cves: CVE-2025-64439 Source advisory: SNYK:PYTHON-LANGGRAPH-13843663...

chainlite (>=0.3.6, <=0.3.7), quivr-modified-milvus (0.1.1) potentially affected by CVE-2025-64439 via langgraph-checkpoint (2.0.1)

langgraph-checkpoint PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - chainlite =0.3.6, =0.3.7 - quivr-modified-milvus 0.1.1 Source cves: CVE-2025-64439 Source advisory: OSV:GHSA-WWQV-P2PP-9...

PT-2025-45384

Name of the Vulnerable Software and Affected Versions LangGraph versions 2.1.2 and below Description LangGraph’s SQLite Checkpoint, which utilizes SQLite databases for checkpoint saving, contains a Remote Code Execution RCE issue in the JsonPlusSerializer when deserializing payloads saved in "jso...

PT-2025-48485

Уязвимость реализации протокола сериализации JsonPlusSerializer паттерна сохранения состояния LangGraph Checkpoint системы управления базами данных SQLite связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить...