planning-library (0.1.4) potentially affected by CVE-2026-28277 via langgraph (0.0.26)

langgraph PYPI version 0.0.26 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - planning-library 0.1.4 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

droughty (>=0.16.0, <=0.19.0) potentially affected by CVE-2026-28277 via langgraph (0.2.64)

langgraph PYPI version 0.2.64 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - droughty =0.16.0, =0.19.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

myscalekb-agent-base (>=0.0.1, <=0.1.6), originhub-myscalekb-agent-base (>=0.1.8, <=0.2.0) potentially affected by CVE-2026-28277 via langgraph (0.2.35)

langgraph PYPI version 0.2.35 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - myscalekb-agent-base =0.0.1, =0.1.8, =0.2.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

scrapontologies (0.0.2) potentially affected by CVE-2026-28277 via langgraph (0.2.30)

langgraph PYPI version 0.2.30 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - scrapontologies 0.0.2 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

autonomous-agent (0.0.1), kgraphplanner (0.0.2) potentially affected by CVE-2026-28277 via langgraph (0.2.3)

langgraph PYPI version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - autonomous-agent 0.0.1 - kgraphplanner 0.0.2 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

flo-ai (>=0.0.4rc1, <=0.0.6.dev3), quivr-modified-milvus (0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.2.38)

langgraph PYPI version 0.2.38 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - flo-ai =0.0.4rc1, =0.0.6.dev3 - quivr-modified-milvus 0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

enable-ai (>=0.1.0, <=0.4.1), freiburg-ris-ca (0.1.0) +1 more potentially affected by CVE-2026-28277 via langgraph (0.2.31)

langgraph PYPI version 0.2.31 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - enable-ai =0.1.0, =0.4.1 - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

adxp-cli (>=0.1.1, <=0.1.21), agent-builder (>=0.0.2, <=0.1.7) +72 more potentially affected by CVE-2026-28277 via langgraph (>=1.0.0a3, <=1.0.9)

langgraph PYPI version =1.0.0a3, =0.1.1, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =3.0.3, =0.0.2, =0.0.597, =0.1.4, =1.0.0, =0.1.0, =0.1.8, =0.1.92 and more Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

osintgraph (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.6.2)

langgraph PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - osintgraph =0.1.0, =0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

meez (0.2.16) potentially affected by CVE-2026-28277 via langgraph (0.6.0)

langgraph PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - meez 0.2.16 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

diagram-to-iac (1.0.6) potentially affected by CVE-2026-28277 via langgraph (0.4.9)

langgraph PYPI version 0.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - diagram-to-iac 1.0.6 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

cuga (0.1.0), katalyst (0.9.1) +1 more potentially affected by CVE-2026-28277 via langgraph (0.5.3)

langgraph PYPI version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - cuga 0.1.0 - katalyst 0.9.1 - meez =0.2.11, =0.2.14 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

coshop (>=0.1.0, <=0.1.1), diagram-to-iac (>=0.8.0, <=1.0.5) +6 more potentially affected by CVE-2026-28277 via langgraph (0.4.8)

langgraph PYPI version 0.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - coshop =0.1.0, =0.8.0, =0.1.0, =0.0.11, =0.0.3, =0.0.10 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

agentstr-sdk (>=0.6.4, <=0.6.8), chemgraph (0.6.0) +7 more potentially affected by CVE-2026-28277 via langgraph (0.4.7)

langgraph PYPI version 0.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - agentstr-sdk =0.6.4, =0.2.0, =0.1.0, =0.1.1, =1.0.0, =0.0.3, =0.1.0a4, =0.1.0a5 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

kno-sdk (>=1.2.0, <=1.4.10) potentially affected by CVE-2026-28277 via langgraph (0.3.33)

langgraph PYPI version 0.3.33 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - kno-sdk =1.2.0, =1.4.10 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

core4ai (>=1.1.6, <=1.3.1), knowai (0.2.3) potentially affected by CVE-2026-28277 via langgraph (0.3.31)

langgraph PYPI version 0.3.31 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - core4ai =1.1.6, =1.3.1 - knowai 0.2.3 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

biomni-bridge (>=0.3.1, <=0.3.3), copilotkit (>=0.1.50, <=0.1.52a2) potentially affected by CVE-2026-28277 via langgraph (0.3.18)

langgraph PYPI version 0.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - biomni-bridge =0.3.1, =0.1.50, =0.1.52a2 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

converso (0.1.1) potentially affected by CVE-2026-28277 via langgraph (0.0.15)

langgraph PYPI version 0.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - converso 0.1.1 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

langchain-pangu (>=0.1.1, <=0.2.3), tolstoy-agents (>=0.1.29, <=0.1.49) +1 more potentially affected by CVE-2026-28277 via langgraph (0.2.16)

langgraph PYPI version 0.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - langchain-pangu =0.1.1, =0.1.29, =0.2.2, =0.3.5 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

PYSEC-2026-83

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...