langgraph-0.0.44-py3-none-any.whl: 1 vulnerabilities (highest severity is: 6.8)

[mend-bolt-for-github]

Vulnerable Library - langgraph-0.0.44-py3-none-any.whl

langgraph

Library home page: https://files.pythonhosted.org/packages/9f/cf/1e1a3bd03486ee5eaaae701d67a4f279a8aa9660f9ec38bf97e955d054d6/langgraph-0.0.44-py3-none-any.whl

Path to dependency file: /ai/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260331025725_MIUFBE/python_UVEQHS/20260331025831/6/langgraph-0.0.44-py3-none-any.whl

Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (langgraph version)	Remediation Possible**
CVE-2026-28277	Medium	6.8	langgraph-0.0.44-py3-none-any.whl	Direct	1.0.10	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-28277

Vulnerable Library - langgraph-0.0.44-py3-none-any.whl

langgraph

Library home page: https://files.pythonhosted.org/packages/9f/cf/1e1a3bd03486ee5eaaae701d67a4f279a8aa9660f9ec38bf97e955d054d6/langgraph-0.0.44-py3-none-any.whl

Path to dependency file: /ai/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260331025725_MIUFBE/python_UVEQHS/20260331025831/6/langgraph-0.0.44-py3-none-any.whl

Dependency Hierarchy:

• ❌ langgraph-0.0.44-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183

Found in base branch: main

Vulnerability Details

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.

Publish Date: 2026-03-05

URL: CVE-2026-28277

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g48c-2wqr-h844

Release Date: 2026-03-05

Fix Resolution: 1.0.10

Step up your Open Source Security Game with Mend here