PyPI/langgraph-checkpoint-postgres CVE-2026-115883: medium 6, EPSS 0.30%
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
Action: Upgrade langgraph-checkpoint-postgres to 3.1.3 or later.
pip install langgraph-checkpoint-postgres==3.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.3 | - |
Fixed versions
| 3.1.3 |
Sources
- osv: GHSA-6hmw-9432-67qq
- nvd: CVE-2026-115883
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-6hmw-9432-67qq
- https://github.com/langchain-ai/langgraph/pull/9217
- https://github.com/langchain-ai/langgraph/commit/bfcfea554ed5c7f7be562cebf8825e911b493ab1
- https://github.com/langchain-ai/langgraph
- https://github.com/langchain-ai/langgraph/releases/tag/checkpointpostgres%3D%3D3.1.3
- https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D3.1.2
CVE-2026-115883 · published · modified · JSON