langgraph
Build resilient agents.
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 276
- Cadence
- ~6 days
- Last 12 months
- 48
Reach
- Stars
- 40.9k
Details
- License
- MIT
- First release
- Jan 08, 2024
| Version | Released | |
|---|---|---|
1.2.11
patch
| ||
1.2.10
patch
| ||
1.2.9
patch
| ||
1.2.8
patch
| ||
1.2.7
patch
| ||
1.2.6
patch
| ||
1.2.5
patch
| ||
1.2.4
patch
| ||
1.2.3
patch
| ||
1.2.2
patch
| ||
1.2.1
patch
| ||
1.2.0
minor
| ||
1.2.0a7
pre
| ||
1.2.0a6
pre
| ||
1.2.0a5
pre
| ||
1.2.0a4
pre
| ||
1.2.0a3
pre
| ||
1.2.0a2
pre
| ||
1.2.0a1
pre
| ||
1.1.10
patch
| ||
1.1.9
patch
| ||
1.1.8
patch
| ||
1.1.7
patch
| ||
1.1.7a2
pre
| ||
1.1.7a1
pre
| ||
1.1.6
patch
| ||
1.1.5
patch
| ||
1.1.4
patch
| ||
1.1.3
patch
| ||
1.1.2
patch
| ||
1.1.1
patch
| ||
1.1.0
minor
| ||
1.0.10
patch
| ||
1.0.10rc1
pre
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.9
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.8
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.7
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.6
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.5
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.4
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.3
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.2
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
0.6.11
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.1
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.0
major
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.0rc1
pre
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
0.6.10
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
0.6.9
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
1.0.0a4
pre
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
| ||
0.6.8
patch
1 CVE
CVE-2026-28277
GHSA-g48c-2wqr-h844
PYSEC-2026-83
Mar 05, 2026
LangGraph checkpoint loading has unsafe msgpack deserialization
6.8
/ 10
Medium
Adjacent
Low
High
None
Unchanged
High
High
High
LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. This is a post-exploitation / defense-in-depth issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime). There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise. Affected users / systemsUsers may be affected if they:
This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment. Impact
Exploitation scenario (high level)
Mitigation / remediationLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization. Strict mode (environment variable)
|