PyPI/langgraph-checkpoint-sqlite CVE-2026-115883: medium 6, EPSS 0.30%

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Action: Upgrade langgraph-checkpoint-sqlite to 3.1.2 or later.

pip install langgraph-checkpoint-sqlite==3.1.2

Affected

Fixed versions

Sources

• osv: GHSA-6hmw-9432-67qq#PyPI/langgraph-checkpoint-sqlite
• nvd: CVE-2026-115883
• https://github.com/langchain-ai/langgraph/security/advisories/GHSA-6hmw-9432-67qq
• https://github.com/langchain-ai/langgraph/pull/9217
• https://github.com/langchain-ai/langgraph/commit/bfcfea554ed5c7f7be562cebf8825e911b493ab1
• https://github.com/langchain-ai/langgraph
• https://github.com/langchain-ai/langgraph/releases/tag/checkpointpostgres%3D%3D3.1.3
• https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D3.1.2

CVE-2026-115883 · published 2026-10-23T22:06:44Z · modified 2026-10-23T22:15:03.645110544Z · JSON