kgraphplanner (0.0.2) potentially affected by CVE-2026-27794 via langgraph-checkpoint (1.0.2)

langgraph-checkpoint PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner 0.0.2 Source cves: CVE-2026-27794 Source advisory: OSV:GHSA-MHR3-J7M5-C7C9...

kgraphplanner (>=0.0.12, <=0.0.13) potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.0.7)

langgraph-checkpoint PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - kgraphplanner =0.0.12, =0.0.13 Source cves: CVE-2026-27794 Source advisory: OSV:GHSA-MHR3-J7M5-C7C9...

chainlite (>=0.3.6, <=0.3.7), quivr-modified-milvus (0.1.1) potentially affected by CVE-2026-27794 via langgraph-checkpoint (2.0.1)

langgraph-checkpoint PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - chainlite =0.3.6, =0.3.7 - quivr-modified-milvus 0.1.1 Source cves: CVE-2026-27794 Source advisory: OSV:GHSA-MHR3-J7M5-C...

CVE-2026-27794

A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. If msgpack...

CVE-2026-27794

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +389 more potentially affected by CVE-2026-27794 via langgraph-checkpoint (>=1.0.2, <=3.0.1)

langgraph-checkpoint PYPI version =1.0.2, =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.2.0a1, =0.2.5a2, =0.0.3rc0, =0.0.3rc4 - agentfence 0.1.0 and more Source cves: CVE-2026-27794 Source advisory: MEND:CVE-2026-27794...

CVE-2026-27794 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

CVE-2026-27794 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

CVE-2026-27794

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

CVE-2026-27794 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

CVE-2026-27794

LangGraph CVE-2026-27794 affects the Checkpoint component prior to version 4.0.0 where the BaseCache default serializer (JsonPlusSerializer with pickle_fallback) can deserialize attacker-supplied bytes from a cache backend if the application enables caching and nodes opt into CachePolicy. An atta...

CVE-2026-27794: Deserialization of Untrusted Data

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to...

langgraph code issue vulnerability

Langgraph is a large-scale model framework developed by LangChain. Versions of Langgraph prior to 4.0.0 had code-related vulnerabilities. These vulnerabilities stemmed from the caching layer’s ability to deserialize cached values using pickle.loads when msgpack serialization fails, potentially...

PT-2026-21967

Name of the Vulnerable Software and Affected Versions LangGraph versions prior to 4.0.0 Description A Remote Code Execution issue exists in LangGraph's caching layer when applications enable cache backends inheriting from BaseCache and opt nodes into caching via CachePolicy. Prior to version 4.0....

Exploit for CVE-2025-67644

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection...

@langgraph-js/pure-graph (>=1.3.0, <=1.5.3), @langgraph-js/sdk (>=3.0.0, <=3.1.0) +1 more potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-redis (0.0.2)

@langchain/langgraph-checkpoint-redis NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-redis and may be impacted: - @langgraph-js/pure-graph =1.3.0, =3.0.0, =3.0.0, =3.0.1 Source cves: CVE-2026-27022...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8), @sonic-agent-kit/agent-setup-lib (>=1.0.5, <=1.0.6) +1 more potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-mongodb (>=0.0.2, <=1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version =0.0.2, =0.2.7, =1.0.5, =1.0.0, =1.0.27 Source cves: CVE-2026-27022 Source advisory: MEND:CVE-2026-27022...

CVE-2026-27022 RediSearch Query Injection in @langchain/langgraph-checkpoint-redis

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directl...

CVE-2026-27022: Improper Neutralization of Special Elements in Output Used by a Downstream Component

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directl...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8) potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.2.8 Source cves: CVE-2026-27022 Source advisory:...