lg-agents (>=0.0.11, <=0.0.15), ttyg (1.0.0) potentially affected by CVE-2026-28277 via langgraph (0.4.3)

langgraph PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - lg-agents =0.0.11, =0.0.15 - ttyg 1.0.0 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

docai-dev (>=0.2.0, <=0.3.0), docailite (>=0.4.0, <=0.6.0) +5 more potentially affected by CVE-2026-28277 via langgraph (0.4.5)

langgraph PYPI version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - docai-dev =0.2.0, =0.4.0, =0.8.0, =0.0.19, =0.0.24 - quivr-modified-milvus 0.1.0 - shizheng-mcpdemo-server 0.3.0 Source cves: CVE-2026-28277...

agentstr-sdk (>=0.6.4, <=0.6.8), chemgraph (0.6.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.4.7)

langgraph PYPI version 0.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - agentstr-sdk =0.6.4, =0.2.0, =0.1.0, =0.1.1, =1.0.0, =0.0.3, =0.1.0a4, =0.1.0a5 Source cves: CVE-2026-28277 Source advisory:...

coshop (>=0.1.0, <=0.1.1), diagram-to-iac (>=0.8.0, <=1.0.5) +6 more potentially affected by CVE-2026-28277 via langgraph (0.4.8)

langgraph PYPI version 0.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - coshop =0.1.0, =0.8.0, =0.1.0, =0.0.11, =0.0.3, =0.0.10 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

ag-ui-langgraph (>=0.0.1a1, <=0.0.4), copilotkit (>=0.1.52a1, <=0.1.57) +6 more potentially affected by CVE-2026-28277 via langgraph (0.5.0)

langgraph PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - ag-ui-langgraph =0.0.1a1, =0.1.52a1, =1.4.0, =0.3.0, =0.1.18, =0.0.1.dev0, =0.1.0a1, =1.2.0, =1.5.0 Source cves: CVE-2026-28277 Source advisor...

a2a-client-handler (0.1.0), diagram-to-iac (1.19.0) +2 more potentially affected by CVE-2026-28277 via langgraph (0.5.1)

langgraph PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - a2a-client-handler 0.1.0 - diagram-to-iac 1.19.0 - meez =0.2.0, =0.2.1, =0.3.2 Source cves: CVE-2026-28277 Source advisory:...

meez (>=0.2.9, <=0.2.10), repolaunch (>=1.4.2, <=1.4.3) potentially affected by CVE-2026-28277 via langgraph (0.5.2)

langgraph PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - meez =0.2.9, =1.4.2, =1.4.3 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

cuga (0.1.0), katalyst (0.9.1) +1 more potentially affected by CVE-2026-28277 via langgraph (0.5.3)

langgraph PYPI version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - cuga 0.1.0 - katalyst 0.9.1 - meez =0.2.11, =0.2.14 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

abs-langchain-suite (>=0.1.5, <=0.2.0), agentc-langgraph (>=0.2.5a2, <=1.1.0) +18 more potentially affected by CVE-2026-28277 via langgraph (0.5.4)

langgraph PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - abs-langchain-suite =0.1.5, =0.2.5a2, =1.25.1, =1.0.0, =0.1.0a2, =1.0.0b3, =1.3.0, =0.1.1, =0.1.0, =0.1.28a6, =0.2.13, =0.1.17, =0.0.8, =0.2.0...

chat-cvdpm (>=0.1.7, <=0.1.13), codeviewx (0.2.8) +2 more potentially affected by CVE-2026-28277 via langgraph (0.6.10)

langgraph PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - chat-cvdpm =0.1.7, =0.1.1, =0.1.7 - iflow-mcp-kerwinmai-multi-agent-exp 2.1.0 Source cves: CVE-2026-28277 Source advisory:...

adxp-cli (>=0.1.1, <=0.1.21), agent-builder (>=0.0.2, <=0.1.7) +71 more potentially affected by CVE-2026-28277 via langgraph (>=1.0.0a3, <=1.0.9)

langgraph PYPI version =1.0.0a3, =0.1.1, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =3.0.3, =0.0.2, =0.0.597, =0.1.4, =1.0.0, =0.1.0, =0.1.8, =0.1.92 and more Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

CVE-2026-28277

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-28277 via langgraph (0.2.28)

langgraph PYPI version 0.2.28 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

PYSEC-2026-83

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

PYSEC-2026-83

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...

converso (0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.0.15)

langgraph PYPI version 0.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - converso 0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

docugami-langchain (>=0.0.7rc1, <=0.0.7rc6) potentially affected by CVE-2026-28277 via langgraph (0.0.24)

langgraph PYPI version 0.0.24 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - docugami-langchain =0.0.7rc1, =0.0.7rc6 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

algorin-cli (>=0.0.1, <=0.21.0) potentially affected by CVE-2026-28277 via langgraph (0.0.29)

langgraph PYPI version 0.0.29 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - algorin-cli =0.0.1, =0.21.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

miksiai (>=1.0.6, <=1.0.12) potentially affected by CVE-2026-28277 via langgraph (0.0.31)

langgraph PYPI version 0.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - miksiai =1.0.6, =1.0.12 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

dialog-lib (>=0.0.1.12, <=0.0.1.18), langchain-postgres (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2026-28277 via langgraph (0.0.32)

langgraph PYPI version 0.0.32 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - dialog-lib =0.0.1.12, =0.0.1, =0.1.3, =0.1.17 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...