{"action":"Upgrade langgraph-checkpoint to 3.0.0 or later.","affected":[{"fixed":"3.0.0","introduced":"0"}],"component":"langgraph-checkpoint","cve_ids":["CVE-2025-64439"],"ecosystem":"PyPI","epss":0.00887,"exploited":false,"fixed_versions":["3.0.0"],"ghsa_id":"GHSA-wwqv-p2pp-99h5","id":"tcs_01M5KGT4GJAVMC0MV1JZC173F4","modified_at":"2026-07-07T17:46:36.753355570Z","published_at":"2026-07-07T16:03:09.680073Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1527","https://github.com/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5","https://nvd.nist.gov/vuln/detail/CVE-2025-64439","https://github.com/langchain-ai/langgraph/commit/c5744f583b11745cd406f3059903e17bbcdcc8ac","https://github.com/langchain-ai/langgraph","https://github.com/langchain-ai/langgraph/blob/c5744f583b11745cd406f3059903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py","https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0","https://pypi.org/project/langgraph-checkpoint","https://github.com/advisories/GHSA-wwqv-p2pp-99h5"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1527","url":"https://osv.dev/vulnerability/PYSEC-2026-1527"},{"source":"nvd","source_id":"CVE-2025-64439","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64439"}],"summary":"LangGraph Checkpoint affected by RCE in \"json\" mode of JsonPlusSerializer"}