CVE-2026-28277
2 advisories.
PyPI/langgraph CVE-2026-28277: medium 6.8, EPSS 0.66%
LangGraph checkpoint loading has unsafe msgpack deserialization
Action: Upgrade langgraph to 1.0.10 or later.
pip install langgraph==1.0.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.10 | - |
Fixed versions
| 1.0.10 |
Sources
- osv: GHSA-g48c-2wqr-h844
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844
- https://nvd.nist.gov/vuln/detail/CVE-2026-28277
- https://github.com/langchain-ai/langgraph
- https://github.com/pypa/advisory-database/tree/main/vulns/langgraph/PYSEC-2026-83.yaml
CVE-2026-28277 · published · modified · JSON
PyPI/langgraph CVE-2026-28277: high 7.2, EPSS 0.66%
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msg
Action: Upgrade langgraph to 1.0.10rc1 or later.
pip install langgraph==1.0.10rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.10rc1 | - |
Fixed versions
| 1.0.10rc1 |
Sources
- osv: PYSEC-2026-83
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844
CVE-2026-28277 · published · modified · JSON