PyPI/langgraph CVE-2026-28277: medium 6.8, EPSS 5.49%
LangGraph checkpoint loading has unsafe msgpack deserialization
Action: Upgrade langgraph to 1.0.10 or later.
pip install langgraph==1.0.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.10 | - |
Fixed versions
| 1.0.10 |
Sources
- osv: GHSA-g48c-2wqr-h844
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844
- https://nvd.nist.gov/vuln/detail/CVE-2026-28277
- https://github.com/langchain-ai/langgraph
- https://github.com/pypa/advisory-database/tree/main/vulns/langgraph/PYSEC-2026-83.yaml
CVE-2026-28277 · published · modified · JSON