10 matches found
CVE-2026-55235
langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...
CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
SummaryIn affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...
GHSA-2C9Q-C2Q9-QGQV langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...
EUVD-2025-177040
Malicious code in process-loopback-cosmos-leda npm...
Malicious code in sagitta-xml-child-process-loopback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a994e3d9f806b277e2a6fe89497b8bd8b217966da20b43ec15ace8cfad2690ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-122291
Malicious code in sagitta-xml-child-process-loopback npm...