mcp-hybrid-search (>=1.1.2, <=1.1.7) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.20)

langgraph-checkpoint PYPI version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - mcp-hybrid-search =1.1.2, =1.1.7 Source cves: CVE-2026-48775 Source advisory: OSV:GHSA-FJQC-HQ36-QH5P...

chainlite (>=0.3.6, <=0.3.7), quivr-modified-milvus (0.1.1) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.1)

langgraph-checkpoint PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - chainlite =0.3.6, =0.3.7 - quivr-modified-milvus 0.1.1 Source cves: CVE-2026-48775 Source advisory: OSV:GHSA-FJQC-HQ36-Q...

terminaider (>=0.1.1, <=0.1.3) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.2)

langgraph-checkpoint PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - terminaider =0.1.1, =0.1.3 Source cves: CVE-2026-48775 Source advisory: OSV:GHSA-FJQC-HQ36-QH5P...

kgraphplanner (>=0.0.12, <=0.0.13) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.7)

langgraph-checkpoint PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner =0.0.12, =0.0.13 Source cves: CVE-2026-48775 Source advisory: OSV:GHSA-FJQC-HQ36-QH5P...

readet (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.8)

langgraph-checkpoint PYPI version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - readet =0.1.0, =0.1.1 Source cves: CVE-2026-48775 Source advisory: OSV:GHSA-FJQC-HQ36-QH5P...

baicai-base (0.1.2), baicai-tutor (0.1.0) potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.25)

langgraph-checkpoint PYPI version 2.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - baicai-base 0.1.2 - baicai-tutor 0.1.0 Source cves: CVE-2026-48775 Source advisory: OSV:GHSA-FJQC-HQ36-QH5P...

agentfoundry (1.2.9.1), py-agent-search (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.0.26)

langgraph-checkpoint PYPI version 2.0.26 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - agentfoundry 1.2.9.1 - py-agent-search =1.0.0, =0.1.0, =1.3.41 Source cves: CVE-2026-48775 Source advisory:...

abs-langchain-suite (>=0.1.5, <=0.2.0), actava (0.1.1) +235 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (2.1.2)

langgraph-checkpoint PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - abs-langchain-suite =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.2.0a1, =0.2.5a2, =0.0.3rc0, =0.8.0, =0.1.2, =0.1.25 -...

coze-coding-utils (0.2.0), langchain-timbr (>=2.1.11, <=3.3.0) +1 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (3.0.0)

langgraph-checkpoint PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - coze-coding-utils 0.2.0 - langchain-timbr =2.1.11, =0.3.2, =0.4.1 Source cves: CVE-2026-48775 Source advisory:...

agent-nexus-cli (>=0.1.0, <=0.1.31), agentiva (>=0.1.0, <=0.1.5) +6 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (>=4.0.0, <=4.1.0)

langgraph-checkpoint PYPI version =4.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.16, =4.1.2, =0.1.5, =0.1.0, =0.1.3 Source cves: CVE-2026-48775 Source advisory: GHSA-FJQC-HQ36-QH5P...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Overview langgraph-sdk is a SDK for interacting with LangGraph API Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in the construction of HTTP request paths using unsanitized identifier values. An attacker can gain...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +341 more potentially affected by CVE-2026-48776 via langgraph-sdk (>=0.1.33, <=0.3.14)

langgraph-sdk PYPI version =0.1.33, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-48776 Source advisory: SNYK:PYTHON-LANGGRAPHSDK-17372912...

CVE-2026-48776

A flaw was found in the LangGraph Python SDK. This vulnerability allows a remote attacker with low privileges to manipulate URL paths by providing unsanitized input. This could result in unintended access, modification, or deletion of resources, potentially compromising data confidentiality and...

CVE-2026-48776

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...

PYSEC-2026-2194

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...

PYSEC-2026-2194

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...

actava (0.1.1), actava-cli (0.1.1) +152 more potentially affected by CVE-2026-48776 via langgraph (>=0.0.15, <=0.3.11)

langgraph PYPI version =0.0.15, =0.1.0, =0.1.1, =0.0.2, =0.8.0, =0.1.2, =0.5.0, =0.1.3, =0.0.45, =0.0.1, =1.8.2, =0.5.0b2, =0.5.25 and more Source cves: CVE-2026-48776 Source advisory: OSV:PYSEC-2026-2194...

CVE-2026-48775

A flaw was found in LangGraph. This vulnerability allows an attacker with high privileges and adjacent network access to modify checkpoint data. By manipulating these stored checkpoint bytes, an attacker can trigger insecure deserialization, leading to arbitrary code execution when the checkpoint...

CVE-2026-48776: Improper Limitation of a Pathname to a Restricted Directory

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...

CVE-2026-48776 LangGraph SDK has unsafe URL path construction

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource...