{"action":"Upgrade langgraph-checkpoint to 3.0.0 or later.","affected":[{"fixed":"3.0.0","introduced":"0"}],"component":"langgraph-checkpoint","cve_ids":["CVE-2025-64439"],"ecosystem":"PyPI","epss":0.00887,"exploited":false,"fixed_versions":["3.0.0"],"ghsa_id":"GHSA-wwqv-p2pp-99h5","id":"tcs_01M5KG306RBBT6GK9HFNGKE42G","modified_at":"2026-07-07T17:56:18.504801770Z","published_at":"2025-11-05T19:52:50Z","references":["https://osv.dev/vulnerability/GHSA-wwqv-p2pp-99h5","https://github.com/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5","https://nvd.nist.gov/vuln/detail/CVE-2025-64439","https://github.com/langchain-ai/langgraph/commit/c5744f583b11745cd406f3059903e17bbcdcc8ac","https://github.com/langchain-ai/langgraph","https://github.com/langchain-ai/langgraph/blob/c5744f583b11745cd406f3059903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py","https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-wwqv-p2pp-99h5","url":"https://osv.dev/vulnerability/GHSA-wwqv-p2pp-99h5"},{"source":"nvd","source_id":"CVE-2025-64439","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64439"}],"summary":"LangGraph Checkpoint affected by RCE in \"json\" mode of JsonPlusSerializer"}