{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-28277", "tracking": { "current_release_date": "2026-03-23T03:47:15.978054Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-28277", "initial_release_date": "2026-03-05T19:38:51.752194Z", "revision_history": [ { "date": "2026-03-05T19:38:51.752194Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-05T19:39:00.729402Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-05T20:47:07.293932Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-05T20:47:12.639009Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-05T21:06:55.853429Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-05T21:06:57.766557Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-05T22:48:53.240186Z", "number": "7", "summary": "References created (1)." }, { "date": "2026-03-06T00:37:27.394272Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (80).| Product Identifiers created (242).| Products connected (163).| References created (2).| CWES updated (1)." }, { "date": "2026-03-06T14:53:24.704480Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-06T14:53:26.531074Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-03-06T18:38:50.753980Z", "number": "11", "summary": "Unknown change." }, { "date": "2026-03-09T13:39:54.543286Z", "number": "12", "summary": "Description removed for source.| Description created for source." }, { "date": "2026-03-09T18:36:05.240205Z", "number": "13", "summary": "Description removed for source.| Description created for source.| Products created (2).| Product Identifiers created (1).| Products removed (1)." }, { "date": "2026-03-09T18:36:20.974216Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:37:52.092763Z", "number": "15", "summary": "Source connected.| CVE status created. (valid)| EPSS created." } ], "status": "interim", "version": "15" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.0.10", "product": { "name": "vers:unknown/0.0.10", "product_id": "CSAFPID-5765240", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.11", "product": { "name": "vers:unknown/0.0.11", "product_id": "CSAFPID-5765241", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.12", "product": { "name": "vers:unknown/0.0.12", "product_id": "CSAFPID-5765242", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.13", "product": { "name": "vers:unknown/0.0.13", "product_id": "CSAFPID-5765243", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.13" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.14", "product": { "name": "vers:unknown/0.0.14", "product_id": "CSAFPID-5765244", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.14" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.15", "product": { "name": "vers:unknown/0.0.15", "product_id": "CSAFPID-5765245", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.15" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.16", "product": { "name": "vers:unknown/0.0.16", "product_id": "CSAFPID-5765246", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.16" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.17", "product": { "name": "vers:unknown/0.0.17", "product_id": "CSAFPID-5765247", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.17" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.18", "product": { "name": "vers:unknown/0.0.18", "product_id": "CSAFPID-5765248", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.18" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.19", "product": { "name": "vers:unknown/0.0.19", "product_id": "CSAFPID-5765249", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.19" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.20", "product": { "name": "vers:unknown/0.0.20", "product_id": "CSAFPID-5765250", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.20" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.21", "product": { "name": "vers:unknown/0.0.21", "product_id": "CSAFPID-5765251", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.21" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.22", "product": { "name": "vers:unknown/0.0.22", "product_id": "CSAFPID-5765252", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.22" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.23", "product": { "name": "vers:unknown/0.0.23", "product_id": "CSAFPID-5765253", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.23" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.24", "product": { "name": "vers:unknown/0.0.24", "product_id": "CSAFPID-5765254", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.24" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.25", "product": { "name": "vers:unknown/0.0.25", "product_id": "CSAFPID-5765255", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.25" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.26", "product": { "name": "vers:unknown/0.0.26", "product_id": "CSAFPID-5765256", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.26" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.27", "product": { "name": "vers:unknown/0.0.27", "product_id": "CSAFPID-5765257", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.27" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.28", "product": { "name": "vers:unknown/0.0.28", "product_id": "CSAFPID-5765258", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.28" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.29", "product": { "name": "vers:unknown/0.0.29", "product_id": "CSAFPID-5765259", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.29" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.30", "product": { "name": "vers:unknown/0.0.30", "product_id": "CSAFPID-5765260", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.30" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.31", "product": { "name": "vers:unknown/0.0.31", "product_id": "CSAFPID-5765261", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.31" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.32", "product": { "name": "vers:unknown/0.0.32", "product_id": "CSAFPID-5765262", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.32" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.33", "product": { "name": "vers:unknown/0.0.33", "product_id": "CSAFPID-5765263", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.33" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.34", "product": { "name": "vers:unknown/0.0.34", "product_id": "CSAFPID-5765264", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.34" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.35", "product": { "name": "vers:unknown/0.0.35", "product_id": "CSAFPID-5765265", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.35" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.36", "product": { "name": "vers:unknown/0.0.36", "product_id": "CSAFPID-5765266", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.36" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.37", "product": { "name": "vers:unknown/0.0.37", "product_id": "CSAFPID-5765267", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.37" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.38", "product": { "name": "vers:unknown/0.0.38", "product_id": "CSAFPID-5765268", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.38" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.39", "product": { "name": "vers:unknown/0.0.39", "product_id": "CSAFPID-5765269", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.39" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.40", "product": { "name": "vers:unknown/0.0.40", "product_id": "CSAFPID-5765270", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.40" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.41", "product": { "name": "vers:unknown/0.0.41", "product_id": "CSAFPID-5765271", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.41" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.42", "product": { "name": "vers:unknown/0.0.42", "product_id": "CSAFPID-5765272", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.42" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.43", "product": { "name": "vers:unknown/0.0.43", "product_id": "CSAFPID-5765273", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.43" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.44", "product": { "name": "vers:unknown/0.0.44", "product_id": "CSAFPID-5765274", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.44" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.45", "product": { "name": "vers:unknown/0.0.45", "product_id": "CSAFPID-5765275", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.45" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.46", "product": { "name": "vers:unknown/0.0.46", "product_id": "CSAFPID-5765276", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.46" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.47", "product": { "name": "vers:unknown/0.0.47", "product_id": "CSAFPID-5765277", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.47" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.48", "product": { "name": "vers:unknown/0.0.48", "product_id": "CSAFPID-5765278", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.48" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.49", "product": { "name": "vers:unknown/0.0.49", "product_id": "CSAFPID-5765279", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.49" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.50", "product": { "name": "vers:unknown/0.0.50", "product_id": "CSAFPID-5765280", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.50" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.51", "product": { "name": "vers:unknown/0.0.51", "product_id": "CSAFPID-5765281", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.51" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.52", "product": { "name": "vers:unknown/0.0.52", "product_id": "CSAFPID-5765282", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.52" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.53", "product": { "name": "vers:unknown/0.0.53", "product_id": "CSAFPID-5765283", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.53" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.54", "product": { "name": "vers:unknown/0.0.54", "product_id": "CSAFPID-5765284", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.54" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.55", "product": { "name": "vers:unknown/0.0.55", "product_id": "CSAFPID-5765285", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.55" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.56", "product": { "name": "vers:unknown/0.0.56", "product_id": "CSAFPID-5765286", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.56" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.57", "product": { "name": "vers:unknown/0.0.57", "product_id": "CSAFPID-5765287", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.57" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.58", "product": { "name": "vers:unknown/0.0.58", "product_id": "CSAFPID-5765288", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.58" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.59", "product": { "name": "vers:unknown/0.0.59", "product_id": "CSAFPID-5765289", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.59" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.60", "product": { "name": "vers:unknown/0.0.60", "product_id": "CSAFPID-5765290", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.60" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.61", "product": { "name": "vers:unknown/0.0.61", "product_id": "CSAFPID-5765291", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.61" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.62", "product": { "name": "vers:unknown/0.0.62", "product_id": "CSAFPID-5765292", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.62" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.63", "product": { "name": "vers:unknown/0.0.63", "product_id": "CSAFPID-5765293", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.63" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.64", "product": { "name": "vers:unknown/0.0.64", "product_id": "CSAFPID-5765294", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.64" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.65", "product": { "name": "vers:unknown/0.0.65", "product_id": "CSAFPID-5765295", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.65" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.66", "product": { "name": "vers:unknown/0.0.66", "product_id": "CSAFPID-5765296", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.66" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.67", "product": { "name": "vers:unknown/0.0.67", "product_id": "CSAFPID-5765297", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.67" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.68", "product": { "name": "vers:unknown/0.0.68", "product_id": "CSAFPID-5765298", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.68" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.69", "product": { "name": "vers:unknown/0.0.69", "product_id": "CSAFPID-5765299", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.69" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.8", "product": { "name": "vers:unknown/0.0.8", "product_id": "CSAFPID-5765300", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.9", "product": { "name": "vers:unknown/0.0.9", "product_id": "CSAFPID-5765301", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.0.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1", "product": { "name": "vers:unknown/0.1.1", "product_id": "CSAFPID-5765302", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.10", "product": { "name": "vers:unknown/0.1.10", "product_id": "CSAFPID-5155106", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.11", "product": { "name": "vers:unknown/0.1.11", "product_id": "CSAFPID-5155107", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.12", "product": { "name": "vers:unknown/0.1.12", "product_id": "CSAFPID-5155108", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.13", "product": { "name": "vers:unknown/0.1.13", "product_id": "CSAFPID-5155109", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.13" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.14", "product": { "name": "vers:unknown/0.1.14", "product_id": "CSAFPID-5155110", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.14" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.15", "product": { "name": "vers:unknown/0.1.15", "product_id": "CSAFPID-5155111", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.15" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.16", "product": { "name": "vers:unknown/0.1.16", "product_id": "CSAFPID-5155112", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.16" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.17", "product": { "name": "vers:unknown/0.1.17", "product_id": "CSAFPID-5155113", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.17" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.18", "product": { "name": "vers:unknown/0.1.18", "product_id": "CSAFPID-5765303", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.18" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.19", "product": { "name": "vers:unknown/0.1.19", "product_id": "CSAFPID-5765304", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.19" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.2", "product": { "name": "vers:unknown/0.1.2", "product_id": "CSAFPID-5155114", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.3", "product": { "name": "vers:unknown/0.1.3", "product_id": "CSAFPID-5155115", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.4", "product": { "name": "vers:unknown/0.1.4", "product_id": "CSAFPID-5155116", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.5", "product": { "name": "vers:unknown/0.1.5", "product_id": "CSAFPID-5155117", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.6", "product": { "name": "vers:unknown/0.1.6", "product_id": "CSAFPID-5155118", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.7", "product": { "name": "vers:unknown/0.1.7", "product_id": "CSAFPID-5155119", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.8", "product": { "name": "vers:unknown/0.1.8", "product_id": "CSAFPID-5155120", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.9", "product": { "name": "vers:unknown/0.1.9", "product_id": "CSAFPID-5155121", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.1.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.0", "product": { "name": "vers:unknown/0.2.0", "product_id": "CSAFPID-5155122", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.1", "product": { "name": "vers:unknown/0.2.1", "product_id": "CSAFPID-5155123", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.10", "product": { "name": "vers:unknown/0.2.10", "product_id": "CSAFPID-5155124", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.11", "product": { "name": "vers:unknown/0.2.11", "product_id": "CSAFPID-5155125", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.12", "product": { "name": "vers:unknown/0.2.12", "product_id": "CSAFPID-5155126", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.13", "product": { "name": "vers:unknown/0.2.13", "product_id": "CSAFPID-5155127", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.13" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.14", "product": { "name": "vers:unknown/0.2.14", "product_id": "CSAFPID-5765305", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.14" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.15", "product": { "name": "vers:unknown/0.2.15", "product_id": "CSAFPID-5155128", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.15" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.16", "product": { "name": "vers:unknown/0.2.16", "product_id": "CSAFPID-5155129", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.16" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.17", "product": { "name": "vers:unknown/0.2.17", "product_id": "CSAFPID-5155130", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.17" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.18", "product": { "name": "vers:unknown/0.2.18", "product_id": "CSAFPID-5155131", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.18" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.19", "product": { "name": "vers:unknown/0.2.19", "product_id": "CSAFPID-5155132", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.19" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.2", "product": { "name": "vers:unknown/0.2.2", "product_id": "CSAFPID-5155133", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.20", "product": { "name": "vers:unknown/0.2.20", "product_id": "CSAFPID-5155134", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.20" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.21", "product": { "name": "vers:unknown/0.2.21", "product_id": "CSAFPID-5155135", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.21" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.22", "product": { "name": "vers:unknown/0.2.22", "product_id": "CSAFPID-5155136", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.22" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.23", "product": { "name": "vers:unknown/0.2.23", "product_id": "CSAFPID-5155137", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.23" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.24", "product": { "name": "vers:unknown/0.2.24", "product_id": "CSAFPID-5155138", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.24" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.25", "product": { "name": "vers:unknown/0.2.25", "product_id": "CSAFPID-5155139", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.25" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.26", "product": { "name": "vers:unknown/0.2.26", "product_id": "CSAFPID-5155140", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.26" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.27", "product": { "name": "vers:unknown/0.2.27", "product_id": "CSAFPID-5155141", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.27" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.28", "product": { "name": "vers:unknown/0.2.28", "product_id": "CSAFPID-5155142", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.28" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.29", "product": { "name": "vers:unknown/0.2.29", "product_id": "CSAFPID-5155143", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.29" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.3", "product": { "name": "vers:unknown/0.2.3", "product_id": "CSAFPID-5155144", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.30", "product": { "name": "vers:unknown/0.2.30", "product_id": "CSAFPID-5155145", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.30" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.31", "product": { "name": "vers:unknown/0.2.31", "product_id": "CSAFPID-5155146", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.31" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.32", "product": { "name": "vers:unknown/0.2.32", "product_id": "CSAFPID-5155147", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.32" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.33", "product": { "name": "vers:unknown/0.2.33", "product_id": "CSAFPID-5155148", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.33" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.34", "product": { "name": "vers:unknown/0.2.34", "product_id": "CSAFPID-5155149", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.34" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.35", "product": { "name": "vers:unknown/0.2.35", "product_id": "CSAFPID-5155150", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.35" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.36", "product": { "name": "vers:unknown/0.2.36", "product_id": "CSAFPID-5155151", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.36" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.37", "product": { "name": "vers:unknown/0.2.37", "product_id": "CSAFPID-5155152", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.37" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.38", "product": { "name": "vers:unknown/0.2.38", "product_id": "CSAFPID-5155153", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.38" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.39", "product": { "name": "vers:unknown/0.2.39", "product_id": "CSAFPID-5155154", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.39" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.4", "product": { "name": "vers:unknown/0.2.4", "product_id": "CSAFPID-5155155", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.40", "product": { "name": "vers:unknown/0.2.40", "product_id": "CSAFPID-5155156", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.40" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.41", "product": { "name": "vers:unknown/0.2.41", "product_id": "CSAFPID-5155157", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.41" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.42", "product": { "name": "vers:unknown/0.2.42", "product_id": "CSAFPID-5155158", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.42" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.43", "product": { "name": "vers:unknown/0.2.43", "product_id": "CSAFPID-5155159", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.43" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.44", "product": { "name": "vers:unknown/0.2.44", "product_id": "CSAFPID-5155160", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.44" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.45", "product": { "name": "vers:unknown/0.2.45", "product_id": "CSAFPID-5155161", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.45" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.46", "product": { "name": "vers:unknown/0.2.46", "product_id": "CSAFPID-5155162", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.46" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.47", "product": { "name": "vers:unknown/0.2.47", "product_id": "CSAFPID-5155163", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.47" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.48", "product": { "name": "vers:unknown/0.2.48", "product_id": "CSAFPID-5155164", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.48" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.49", "product": { "name": "vers:unknown/0.2.49", "product_id": "CSAFPID-5155165", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.49" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.5", "product": { "name": "vers:unknown/0.2.5", "product_id": "CSAFPID-5155166", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.50", "product": { "name": "vers:unknown/0.2.50", "product_id": "CSAFPID-5155167", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.50" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.51", "product": { "name": "vers:unknown/0.2.51", "product_id": "CSAFPID-5155168", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.51" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.52", "product": { "name": "vers:unknown/0.2.52", "product_id": "CSAFPID-5155169", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.52" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.53", "product": { "name": "vers:unknown/0.2.53", "product_id": "CSAFPID-5155170", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.53" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.54", "product": { "name": "vers:unknown/0.2.54", "product_id": "CSAFPID-5155171", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.54" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.55", "product": { "name": "vers:unknown/0.2.55", "product_id": "CSAFPID-5155172", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.55" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.56", "product": { "name": "vers:unknown/0.2.56", "product_id": "CSAFPID-5155173", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.56" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.57", "product": { "name": "vers:unknown/0.2.57", "product_id": "CSAFPID-5155174", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.57" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.58", "product": { "name": "vers:unknown/0.2.58", "product_id": "CSAFPID-5155175", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.58" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.59", "product": { "name": "vers:unknown/0.2.59", "product_id": "CSAFPID-5155176", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.59" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.5a0", "product": { "name": "vers:unknown/0.2.5a0", "product_id": "CSAFPID-5765306", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.5a0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.6", "product": { "name": "vers:unknown/0.2.6", "product_id": "CSAFPID-5155177", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.60", "product": { "name": "vers:unknown/0.2.60", "product_id": "CSAFPID-5155178", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.60" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.61", "product": { "name": "vers:unknown/0.2.61", "product_id": "CSAFPID-5155179", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.61" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.62", "product": { "name": "vers:unknown/0.2.62", "product_id": "CSAFPID-5155180", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.62" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.63", "product": { "name": "vers:unknown/0.2.63", "product_id": "CSAFPID-5155181", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.63" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.64", "product": { "name": "vers:unknown/0.2.64", "product_id": "CSAFPID-5155182", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.64" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.65", "product": { "name": "vers:unknown/0.2.65", "product_id": "CSAFPID-5155183", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.65" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.66", "product": { "name": "vers:unknown/0.2.66", "product_id": "CSAFPID-5155184", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.66" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.67", "product": { "name": "vers:unknown/0.2.67", "product_id": "CSAFPID-5155185", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.67" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.68", "product": { "name": "vers:unknown/0.2.68", "product_id": "CSAFPID-5155186", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.68" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.69", "product": { "name": "vers:unknown/0.2.69", "product_id": "CSAFPID-5155187", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.69" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.7", "product": { "name": "vers:unknown/0.2.7", "product_id": "CSAFPID-5155188", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.70", "product": { "name": "vers:unknown/0.2.70", "product_id": "CSAFPID-5155189", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.70" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.71", "product": { "name": "vers:unknown/0.2.71", "product_id": "CSAFPID-5155190", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.71" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.72", "product": { "name": "vers:unknown/0.2.72", "product_id": "CSAFPID-5155191", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.72" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.73", "product": { "name": "vers:unknown/0.2.73", "product_id": "CSAFPID-5155192", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.73" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.74", "product": { "name": "vers:unknown/0.2.74", "product_id": "CSAFPID-5155193", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.74" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.75", "product": { "name": "vers:unknown/0.2.75", "product_id": "CSAFPID-5155194", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.75" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.76", "product": { "name": "vers:unknown/0.2.76", "product_id": "CSAFPID-5155195", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.76" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.7a0", "product": { "name": "vers:unknown/0.2.7a0", "product_id": "CSAFPID-5765307", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.7a0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.8", "product": { "name": "vers:unknown/0.2.8", "product_id": "CSAFPID-5765308", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.9", "product": { "name": "vers:unknown/0.2.9", "product_id": "CSAFPID-5155196", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.2.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0", "product": { "name": "vers:unknown/0.3.0", "product_id": "CSAFPID-5155197", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.1", "product": { "name": "vers:unknown/0.3.1", "product_id": "CSAFPID-5155198", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.10", "product": { "name": "vers:unknown/0.3.10", "product_id": "CSAFPID-5155199", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.11", "product": { "name": "vers:unknown/0.3.11", "product_id": "CSAFPID-5155200", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.12", "product": { "name": "vers:unknown/0.3.12", "product_id": "CSAFPID-5155201", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.13", "product": { "name": "vers:unknown/0.3.13", "product_id": "CSAFPID-5155202", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.13" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.14", "product": { "name": "vers:unknown/0.3.14", "product_id": "CSAFPID-5155203", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.14" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.15", "product": { "name": "vers:unknown/0.3.15", "product_id": "CSAFPID-5155204", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.15" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.16", "product": { "name": "vers:unknown/0.3.16", "product_id": "CSAFPID-5155205", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.16" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.17", "product": { "name": "vers:unknown/0.3.17", "product_id": "CSAFPID-5155206", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.17" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.18", "product": { "name": "vers:unknown/0.3.18", "product_id": "CSAFPID-5155207", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.18" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.19", "product": { "name": "vers:unknown/0.3.19", "product_id": "CSAFPID-5155208", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.19" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.2", "product": { "name": "vers:unknown/0.3.2", "product_id": "CSAFPID-5155209", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.20", "product": { "name": "vers:unknown/0.3.20", "product_id": "CSAFPID-5155210", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.20" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.21", "product": { "name": "vers:unknown/0.3.21", "product_id": "CSAFPID-5155211", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.21" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.22", "product": { "name": "vers:unknown/0.3.22", "product_id": "CSAFPID-5155212", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.22" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.23", "product": { "name": "vers:unknown/0.3.23", "product_id": "CSAFPID-5155213", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.23" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.24", "product": { "name": "vers:unknown/0.3.24", "product_id": "CSAFPID-5155214", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.24" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.25", "product": { "name": "vers:unknown/0.3.25", "product_id": "CSAFPID-5155215", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.25" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.26", "product": { "name": "vers:unknown/0.3.26", "product_id": "CSAFPID-5155216", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.26" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.27", "product": { "name": "vers:unknown/0.3.27", "product_id": "CSAFPID-5155217", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.27" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.28", "product": { "name": "vers:unknown/0.3.28", "product_id": "CSAFPID-5155218", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.28" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.29", "product": { "name": "vers:unknown/0.3.29", "product_id": "CSAFPID-5155219", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.29" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.3", "product": { "name": "vers:unknown/0.3.3", "product_id": "CSAFPID-5155220", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.30", "product": { "name": "vers:unknown/0.3.30", "product_id": "CSAFPID-5155221", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.30" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.31", "product": { "name": "vers:unknown/0.3.31", "product_id": "CSAFPID-5155222", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.31" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.32", "product": { "name": "vers:unknown/0.3.32", "product_id": "CSAFPID-5155223", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.32" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.33", "product": { "name": "vers:unknown/0.3.33", "product_id": "CSAFPID-5765309", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.33" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.34", "product": { "name": "vers:unknown/0.3.34", "product_id": "CSAFPID-5155224", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.34" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.4", "product": { "name": "vers:unknown/0.3.4", "product_id": "CSAFPID-5155225", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.5", "product": { "name": "vers:unknown/0.3.5", "product_id": "CSAFPID-5155226", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.6", "product": { "name": "vers:unknown/0.3.6", "product_id": "CSAFPID-5155227", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.7", "product": { "name": "vers:unknown/0.3.7", "product_id": "CSAFPID-5155228", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.8", "product": { "name": "vers:unknown/0.3.8", "product_id": "CSAFPID-5155229", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.9", "product": { "name": "vers:unknown/0.3.9", "product_id": "CSAFPID-5765310", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.3.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.0", "product": { "name": "vers:unknown/0.4.0", "product_id": "CSAFPID-5155230", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.1", "product": { "name": "vers:unknown/0.4.1", "product_id": "CSAFPID-5155231", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.10", "product": { "name": "vers:unknown/0.4.10", "product_id": "CSAFPID-5765311", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.2", "product": { "name": "vers:unknown/0.4.2", "product_id": "CSAFPID-5155232", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.3", "product": { "name": "vers:unknown/0.4.3", "product_id": "CSAFPID-5155233", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.4", "product": { "name": "vers:unknown/0.4.4", "product_id": "CSAFPID-5155234", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.5", "product": { "name": "vers:unknown/0.4.5", "product_id": "CSAFPID-5155235", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.6", "product": { "name": "vers:unknown/0.4.6", "product_id": "CSAFPID-5155236", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.7", "product": { "name": "vers:unknown/0.4.7", "product_id": "CSAFPID-5155237", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.8", "product": { "name": "vers:unknown/0.4.8", "product_id": "CSAFPID-5765312", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.9", "product": { "name": "vers:unknown/0.4.9", "product_id": "CSAFPID-5765313", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.4.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0", "product": { "name": "vers:unknown/0.5.0", "product_id": "CSAFPID-5155238", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0rc0", "product": { "name": "vers:unknown/0.5.0rc0", "product_id": "CSAFPID-5155239", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.0rc0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0rc1", "product": { "name": "vers:unknown/0.5.0rc1", "product_id": "CSAFPID-5155240", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.1", "product": { "name": "vers:unknown/0.5.1", "product_id": "CSAFPID-5155241", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.2", "product": { "name": "vers:unknown/0.5.2", "product_id": "CSAFPID-5155242", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.3", "product": { "name": "vers:unknown/0.5.3", "product_id": "CSAFPID-5155243", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.4", "product": { "name": "vers:unknown/0.5.4", "product_id": "CSAFPID-5155244", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.5.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0", "product": { "name": "vers:unknown/0.6.0", "product_id": "CSAFPID-5175079", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0a1", "product": { "name": "vers:unknown/0.6.0a1", "product_id": "CSAFPID-5155245", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.0a1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0a2", "product": { "name": "vers:unknown/0.6.0a2", "product_id": "CSAFPID-5175080", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.0a2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.1", "product": { "name": "vers:unknown/0.6.1", "product_id": "CSAFPID-5175081", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.10", "product": { "name": "vers:unknown/0.6.10", "product_id": "CSAFPID-5175082", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.11", "product": { "name": "vers:unknown/0.6.11", "product_id": "CSAFPID-5765314", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.2", "product": { "name": "vers:unknown/0.6.2", "product_id": "CSAFPID-5175083", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3", "product": { "name": "vers:unknown/0.6.3", "product_id": "CSAFPID-5175084", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.4", "product": { "name": "vers:unknown/0.6.4", "product_id": "CSAFPID-5175085", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5", "product": { "name": "vers:unknown/0.6.5", "product_id": "CSAFPID-5175086", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.6", "product": { "name": "vers:unknown/0.6.6", "product_id": "CSAFPID-5175087", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.7", "product": { "name": "vers:unknown/0.6.7", "product_id": "CSAFPID-5175088", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.8", "product": { "name": "vers:unknown/0.6.8", "product_id": "CSAFPID-5175089", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.9", "product": { "name": "vers:unknown/0.6.9", "product_id": "CSAFPID-5175090", "product_identification_helper": { "purl": "pkg:pypi/langgraph@0.6.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0", "product": { "name": "vers:unknown/1.0.0", "product_id": "CSAFPID-5151377", "product_identification_helper": { "purl": "pkg:pypi/langgraph-checkpoint-sqlite@1.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a1", "product": { "name": "vers:unknown/1.0.0a1", "product_id": "CSAFPID-5765315", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.0a1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a2", "product": { "name": "vers:unknown/1.0.0a2", "product_id": "CSAFPID-5765316", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.0a2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a3", "product": { "name": "vers:unknown/1.0.0a3", "product_id": "CSAFPID-5765317", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.0a3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a4", "product": { "name": "vers:unknown/1.0.0a4", "product_id": "CSAFPID-5765318", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.0a4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0rc1", "product": { "name": "vers:unknown/1.0.0rc1", "product_id": "CSAFPID-5175091", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.1", "product": { "name": "vers:unknown/1.0.1", "product_id": "CSAFPID-5151378", "product_identification_helper": { "purl": "pkg:pypi/langgraph-checkpoint@1.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.10rc1", "product": { "name": "vers:unknown/1.0.10rc1", "product_id": "CSAFPID-5772274", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.10rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.2", "product": { "name": "vers:unknown/1.0.2", "product_id": "CSAFPID-5151379", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.3", "product": { "name": "vers:unknown/1.0.3", "product_id": "CSAFPID-5151380", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.4", "product": { "name": "vers:unknown/1.0.4", "product_id": "CSAFPID-5151381", "product_identification_helper": { "purl": "pkg:pypi/langgraph-checkpoint-sqlite@1.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.5", "product": { "name": "vers:unknown/1.0.5", "product_id": "CSAFPID-5168230", "product_identification_helper": { "purl": "pkg:pypi/langgraph-checkpoint@1.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.6", "product": { "name": "vers:unknown/1.0.6", "product_id": "CSAFPID-5168231", "product_identification_helper": { "purl": "pkg:pypi/langgraph-checkpoint@1.0.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.7", "product": { "name": "vers:unknown/1.0.7", "product_id": "CSAFPID-5168232", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.8", "product": { "name": "vers:unknown/1.0.8", "product_id": "CSAFPID-5168233", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.9", "product": { "name": "vers:unknown/1.0.9", "product_id": "CSAFPID-5168234", "product_identification_helper": { "purl": "pkg:pypi/langgraph@1.0.9" } } }, { "category": "product_version_range", "name": "vers:unknown/<=1.0.9", "product": { "name": "vers:unknown/<=1.0.9", "product_id": "CSAFPID-5763733" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<1.0.10", "product": { "name": "vers:unknown/>=0|<1.0.10", "product_id": "CSAFPID-5772275" } } ], "category": "product_name", "name": "langgraph" } ], "category": "vendor", "name": "langchain-ai" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-28277", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "description", "text": "LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-28277" }, { "category": "description", "text": "LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-28277" }, { "category": "description", "text": "LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded.\n\nThis is a **post-exploitation / defense-in-depth** issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime).\n\nThere is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise.\n\n## Affected users / systems\n\nUsers may be affected if they:\n\n- use a persistent checkpointer (database, remote store, shared filesystem, etc.),\n- load/resume from checkpoints, and\n- operate in an environment where an attacker could gain privileged write access to checkpoint data in the backing store.\n\nThis issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment.\n\n## Impact\n- Potential **arbitrary code execution** or other unsafe side effects during checkpoint deserialization.\n- Escalation from “write access to checkpoint store” to “code execution in the application runtime,” which may expose runtime secrets or provide access to other systems the runtime can reach.\n\n## Exploitation scenario (high level)\n1. Attacker gains privileged write access to the checkpoint store (for example, via database compromise, leaked credentials, or abuse of an administrative data path).\n2. Attacker writes a crafted checkpoint payload containing msgpack data intended to reconstruct dangerous objects.\n3. Application resumes and deserializes the checkpoint; unsafe reconstruction could execute attacker-controlled behavior.\n\n## Mitigation / remediation\nLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization.\n\n### Strict mode (environment variable)\n- **`LANGGRAPH_STRICT_MSGPACK`**\n - When set truthy (`1`, `true`, `yes`), the default msgpack deserialization policy becomes strict.\n - Concretely: `JsonPlusSerializer()` will default `allowed_msgpack_modules` to `None` (strict) instead of `True` (warn-and-allow), unless `allowed_msgpack_modules=...` is explicitly passed.\n\n### `allowed_msgpack_modules` (serializer/checkpointer config)\nThis setting controls what msgpack “ext” types are allowed to be reconstructed.\n\n- `True` (default when strict mode is not enabled): allow all ext types, but log a warning when deserializing a type that is not explicitly registered.\n- `None` (strict): only a built-in safe set is reconstructed; other ext types are blocked.\n- `[(module, class_name), ...]` (strict allowlist): the built-in safe set plus exactly the listed symbols are reconstructed (exact-match).\n\n### Built-in safe set\nA small set of types is always treated as safe to reconstruct (for example `datetime` types, `uuid.UUID`, `decimal.Decimal`, `set`/`frozenset`/`deque`, `ipaddress` types, `pathlib` paths, `zoneinfo.ZoneInfo`, compiled regex patterns, and selected LangGraph internal types).\n\n### Automatically derived allowlist (only when compiling graphs)\nWhen `LANGGRAPH_STRICT_MSGPACK` is enabled and `StateGraph` is compiled, LangGraph derives an allowlist from the graph’s schemas and channels and applies it to the checkpointer.\n\n- The allowlist is built by walking the state/input/output/context schemas (plus node/branch input schemas) and channel value/update types. It includes Pydantic v1/v2 models, dataclasses, enums, TypedDict field types, and common typing constructs (containers, unions, `Annotated`).\n- LangGraph also includes a curated set of common LangChain message classes.\n\nThis derived allowlist is only applied if the selected checkpointer supports `with_allowlist(...)`. If a user is constructing serializers/checkpointers manually (or using a checkpointer that does not support allowlist propagation), they will need to configure `allowed_msgpack_modules` themselves.\n\n### Operational guidance\n- Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if compromise is suspected.\n- Enable strict mode (`LANGGRAPH_STRICT_MSGPACK=true`) in production if feasible, and rely on schema-driven allowlisting to reduce incompatibilities.\n- Avoid providing custom msgpack deserialization hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.\n\n## Limitations / important notes\n- If a checkpointer implementation does **not** support allowlist application (i.e., does not implement `with_allowlist`), allowlist enforcement may be skipped (with a warning). In that situation, strict expectations may not hold.\n- If an application supplies a custom msgpack unpack hook (`ext_hook`), the custom hook controls reconstruction and can bypass the default allowlist checks (intentional escape hatch, but it weakens the protection).\n\n## LangSmith / hosted deployments note\nLangSmith is not aware of this issue presenting risk to existing LangSmith-hosted deployments. The described threat model requires an attacker to tamper with the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.\n\nFirst reported by: yardenporat353", "title": "github - https://github.com/advisories/GHSA-g48c-2wqr-h844" }, { "category": "description", "text": "LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded.\n\nThis is a **post-exploitation / defense-in-depth** issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime).\n\nThere is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise.\n\n## Affected users / systems\n\nUsers may be affected if they:\n\n- use a persistent checkpointer (database, remote store, shared filesystem, etc.),\n- load/resume from checkpoints, and\n- operate in an environment where an attacker could gain privileged write access to checkpoint data in the backing store.\n\nThis issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted component that writes them). It is generally not reachable by an unauthenticated remote attacker in a correctly configured deployment.\n\n## Impact\n- Potential **arbitrary code execution** or other unsafe side effects during checkpoint deserialization.\n- Escalation from “write access to checkpoint store” to “code execution in the application runtime,” which may expose runtime secrets or provide access to other systems the runtime can reach.\n\n## Exploitation scenario (high level)\n1. Attacker gains privileged write access to the checkpoint store (for example, via database compromise, leaked credentials, or abuse of an administrative data path).\n2. Attacker writes a crafted checkpoint payload containing msgpack data intended to reconstruct dangerous objects.\n3. Application resumes and deserializes the checkpoint; unsafe reconstruction could execute attacker-controlled behavior.\n\n## Mitigation / remediation\nLangGraph provides an allowlist-based hardening mechanism for msgpack checkpoint deserialization.\n\n### Strict mode (environment variable)\n- **`LANGGRAPH_STRICT_MSGPACK`**\n - When set truthy (`1`, `true`, `yes`), the default msgpack deserialization policy becomes strict.\n - Concretely: `JsonPlusSerializer()` will default `allowed_msgpack_modules` to `None` (strict) instead of `True` (warn-and-allow), unless `allowed_msgpack_modules=...` is explicitly passed.\n\n### `allowed_msgpack_modules` (serializer/checkpointer config)\nThis setting controls what msgpack “ext” types are allowed to be reconstructed.\n\n- `True` (default when strict mode is not enabled): allow all ext types, but log a warning when deserializing a type that is not explicitly registered.\n- `None` (strict): only a built-in safe set is reconstructed; other ext types are blocked.\n- `[(module, class_name), ...]` (strict allowlist): the built-in safe set plus exactly the listed symbols are reconstructed (exact-match).\n\n### Built-in safe set\nA small set of types is always treated as safe to reconstruct (for example `datetime` types, `uuid.UUID`, `decimal.Decimal`, `set`/`frozenset`/`deque`, `ipaddress` types, `pathlib` paths, `zoneinfo.ZoneInfo`, compiled regex patterns, and selected LangGraph internal types).\n\n### Automatically derived allowlist (only when compiling graphs)\nWhen `LANGGRAPH_STRICT_MSGPACK` is enabled and `StateGraph` is compiled, LangGraph derives an allowlist from the graph’s schemas and channels and applies it to the checkpointer.\n\n- The allowlist is built by walking the state/input/output/context schemas (plus node/branch input schemas) and channel value/update types. It includes Pydantic v1/v2 models, dataclasses, enums, TypedDict field types, and common typing constructs (containers, unions, `Annotated`).\n- LangGraph also includes a curated set of common LangChain message classes.\n\nThis derived allowlist is only applied if the selected checkpointer supports `with_allowlist(...)`. If a user is constructing serializers/checkpointers manually (or using a checkpointer that does not support allowlist propagation), they will need to configure `allowed_msgpack_modules` themselves.\n\n### Operational guidance\n- Treat checkpoint stores as integrity-sensitive. Restrict write access and rotate credentials if compromise is suspected.\n- Enable strict mode (`LANGGRAPH_STRICT_MSGPACK=true`) in production if feasible, and rely on schema-driven allowlisting to reduce incompatibilities.\n- Avoid providing custom msgpack deserialization hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.\n\n## Limitations / important notes\n- If a checkpointer implementation does **not** support allowlist application (i.e., does not implement `with_allowlist`), allowlist enforcement may be skipped (with a warning). In that situation, strict expectations may not hold.\n- If an application supplies a custom msgpack unpack hook (`ext_hook`), the custom hook controls reconstruction and can bypass the default allowlist checks (intentional escape hatch, but it weakens the protection).\n\n## LangSmith / hosted deployments note\nLangSmith is not aware of this issue presenting risk to existing LangSmith-hosted deployments. The described threat model requires an attacker to tamper with the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access.\n\nFirst reported by: yardenporat353", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-g48c-2wqr-h844.json?alt=media" }, { "category": "other", "text": "0.00025", "title": "EPSS" }, { "category": "other", "text": "3.6", "title": "NCSC Score" }, { "category": "other", "text": "Is related to CWE-502 (Deserialization of Untrusted Data), The value of the most recent EPSS score, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5763733", "CSAFPID-5151377", "CSAFPID-5151378", "CSAFPID-5151379", "CSAFPID-5151380", "CSAFPID-5151381", "CSAFPID-5155106", "CSAFPID-5155107", "CSAFPID-5155108", "CSAFPID-5155109", "CSAFPID-5155110", "CSAFPID-5155111", "CSAFPID-5155112", "CSAFPID-5155113", "CSAFPID-5155114", "CSAFPID-5155115", "CSAFPID-5155116", "CSAFPID-5155117", "CSAFPID-5155118", "CSAFPID-5155119", "CSAFPID-5155120", "CSAFPID-5155121", "CSAFPID-5155122", "CSAFPID-5155123", "CSAFPID-5155124", "CSAFPID-5155125", "CSAFPID-5155126", "CSAFPID-5155127", "CSAFPID-5155128", "CSAFPID-5155129", "CSAFPID-5155130", "CSAFPID-5155131", "CSAFPID-5155132", "CSAFPID-5155133", "CSAFPID-5155134", "CSAFPID-5155135", "CSAFPID-5155136", "CSAFPID-5155137", "CSAFPID-5155138", "CSAFPID-5155139", "CSAFPID-5155140", "CSAFPID-5155141", "CSAFPID-5155142", "CSAFPID-5155143", "CSAFPID-5155144", "CSAFPID-5155145", "CSAFPID-5155146", "CSAFPID-5155147", "CSAFPID-5155148", "CSAFPID-5155149", "CSAFPID-5155150", "CSAFPID-5155151", "CSAFPID-5155152", "CSAFPID-5155153", "CSAFPID-5155154", "CSAFPID-5155155", "CSAFPID-5155156", "CSAFPID-5155157", "CSAFPID-5155158", "CSAFPID-5155159", "CSAFPID-5155160", "CSAFPID-5155161", "CSAFPID-5155162", "CSAFPID-5155163", "CSAFPID-5155164", "CSAFPID-5155165", "CSAFPID-5155166", "CSAFPID-5155167", "CSAFPID-5155168", "CSAFPID-5155169", "CSAFPID-5155170", "CSAFPID-5155171", "CSAFPID-5155172", "CSAFPID-5155173", "CSAFPID-5155174", "CSAFPID-5155175", "CSAFPID-5155176", "CSAFPID-5155177", "CSAFPID-5155178", "CSAFPID-5155179", "CSAFPID-5155180", "CSAFPID-5155181", "CSAFPID-5155182", "CSAFPID-5155183", "CSAFPID-5155184", "CSAFPID-5155185", "CSAFPID-5155186", "CSAFPID-5155187", "CSAFPID-5155188", "CSAFPID-5155189", "CSAFPID-5155190", "CSAFPID-5155191", "CSAFPID-5155192", "CSAFPID-5155193", "CSAFPID-5155194", "CSAFPID-5155195", "CSAFPID-5155196", "CSAFPID-5155197", "CSAFPID-5155198", "CSAFPID-5155199", "CSAFPID-5155200", "CSAFPID-5155201", "CSAFPID-5155202", "CSAFPID-5155203", "CSAFPID-5155204", "CSAFPID-5155205", "CSAFPID-5155206", "CSAFPID-5155207", "CSAFPID-5155208", "CSAFPID-5155209", "CSAFPID-5155210", "CSAFPID-5155211", "CSAFPID-5155212", "CSAFPID-5155213", "CSAFPID-5155214", "CSAFPID-5155215", "CSAFPID-5155216", "CSAFPID-5155217", "CSAFPID-5155218", "CSAFPID-5155219", "CSAFPID-5155220", "CSAFPID-5155221", "CSAFPID-5155222", "CSAFPID-5155223", "CSAFPID-5155224", "CSAFPID-5155225", "CSAFPID-5155226", "CSAFPID-5155227", "CSAFPID-5155228", "CSAFPID-5155229", "CSAFPID-5155230", "CSAFPID-5155231", "CSAFPID-5155232", "CSAFPID-5155233", "CSAFPID-5155234", "CSAFPID-5155235", "CSAFPID-5155236", "CSAFPID-5155237", "CSAFPID-5155238", "CSAFPID-5155239", "CSAFPID-5155240", "CSAFPID-5155241", "CSAFPID-5155242", "CSAFPID-5155243", "CSAFPID-5155244", "CSAFPID-5155245", "CSAFPID-5168230", "CSAFPID-5168231", "CSAFPID-5168232", "CSAFPID-5168233", "CSAFPID-5168234", "CSAFPID-5175079", "CSAFPID-5175080", "CSAFPID-5175081", "CSAFPID-5175082", "CSAFPID-5175083", "CSAFPID-5175084", "CSAFPID-5175085", "CSAFPID-5175086", "CSAFPID-5175087", "CSAFPID-5175088", "CSAFPID-5175089", "CSAFPID-5175090", "CSAFPID-5175091", "CSAFPID-5765240", "CSAFPID-5765241", "CSAFPID-5765242", "CSAFPID-5765243", "CSAFPID-5765244", "CSAFPID-5765245", "CSAFPID-5765246", "CSAFPID-5765247", "CSAFPID-5765248", "CSAFPID-5765249", "CSAFPID-5765250", "CSAFPID-5765251", "CSAFPID-5765252", "CSAFPID-5765253", "CSAFPID-5765254", "CSAFPID-5765255", "CSAFPID-5765256", "CSAFPID-5765257", "CSAFPID-5765258", "CSAFPID-5765259", "CSAFPID-5765260", "CSAFPID-5765261", "CSAFPID-5765262", "CSAFPID-5765263", "CSAFPID-5765264", "CSAFPID-5765265", "CSAFPID-5765266", "CSAFPID-5765267", "CSAFPID-5765268", "CSAFPID-5765269", "CSAFPID-5765270", "CSAFPID-5765271", "CSAFPID-5765272", "CSAFPID-5765273", "CSAFPID-5765274", "CSAFPID-5765275", "CSAFPID-5765276", "CSAFPID-5765277", "CSAFPID-5765278", "CSAFPID-5765279", "CSAFPID-5765280", "CSAFPID-5765281", "CSAFPID-5765282", "CSAFPID-5765283", "CSAFPID-5765284", "CSAFPID-5765285", "CSAFPID-5765286", "CSAFPID-5765287", "CSAFPID-5765288", "CSAFPID-5765289", "CSAFPID-5765290", "CSAFPID-5765291", "CSAFPID-5765292", "CSAFPID-5765293", "CSAFPID-5765294", "CSAFPID-5765295", "CSAFPID-5765296", "CSAFPID-5765297", "CSAFPID-5765298", "CSAFPID-5765299", "CSAFPID-5765300", "CSAFPID-5765301", "CSAFPID-5765302", "CSAFPID-5765303", "CSAFPID-5765304", "CSAFPID-5765305", "CSAFPID-5765306", "CSAFPID-5765307", "CSAFPID-5765308", "CSAFPID-5765309", "CSAFPID-5765310", "CSAFPID-5765311", "CSAFPID-5765312", "CSAFPID-5765313", "CSAFPID-5765314", "CSAFPID-5765315", "CSAFPID-5765316", "CSAFPID-5765317", "CSAFPID-5765318", "CSAFPID-5772274", "CSAFPID-5772275" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28277" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28277.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28277" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28277" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-g48c-2wqr-h844" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-g48c-2wqr-h844" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-g48c-2wqr-h844.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28277" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-g48c-2wqr-h844" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28277" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-5151377", "CSAFPID-5151378", "CSAFPID-5151379", "CSAFPID-5151380", "CSAFPID-5151381", "CSAFPID-5155106", "CSAFPID-5155107", "CSAFPID-5155108", "CSAFPID-5155109", "CSAFPID-5155110", "CSAFPID-5155111", "CSAFPID-5155112", "CSAFPID-5155113", "CSAFPID-5155114", "CSAFPID-5155115", "CSAFPID-5155116", "CSAFPID-5155117", "CSAFPID-5155118", "CSAFPID-5155119", "CSAFPID-5155120", "CSAFPID-5155121", "CSAFPID-5155122", "CSAFPID-5155123", "CSAFPID-5155124", "CSAFPID-5155125", "CSAFPID-5155126", "CSAFPID-5155127", "CSAFPID-5155128", "CSAFPID-5155129", "CSAFPID-5155130", "CSAFPID-5155131", "CSAFPID-5155132", "CSAFPID-5155133", "CSAFPID-5155134", "CSAFPID-5155135", "CSAFPID-5155136", "CSAFPID-5155137", "CSAFPID-5155138", "CSAFPID-5155139", "CSAFPID-5155140", "CSAFPID-5155141", "CSAFPID-5155142", "CSAFPID-5155143", "CSAFPID-5155144", "CSAFPID-5155145", "CSAFPID-5155146", "CSAFPID-5155147", "CSAFPID-5155148", "CSAFPID-5155149", "CSAFPID-5155150", "CSAFPID-5155151", "CSAFPID-5155152", "CSAFPID-5155153", "CSAFPID-5155154", "CSAFPID-5155155", "CSAFPID-5155156", "CSAFPID-5155157", "CSAFPID-5155158", "CSAFPID-5155159", "CSAFPID-5155160", "CSAFPID-5155161", "CSAFPID-5155162", "CSAFPID-5155163", "CSAFPID-5155164", "CSAFPID-5155165", "CSAFPID-5155166", "CSAFPID-5155167", "CSAFPID-5155168", "CSAFPID-5155169", "CSAFPID-5155170", "CSAFPID-5155171", "CSAFPID-5155172", "CSAFPID-5155173", "CSAFPID-5155174", "CSAFPID-5155175", "CSAFPID-5155176", "CSAFPID-5155177", "CSAFPID-5155178", "CSAFPID-5155179", "CSAFPID-5155180", "CSAFPID-5155181", "CSAFPID-5155182", "CSAFPID-5155183", "CSAFPID-5155184", "CSAFPID-5155185", "CSAFPID-5155186", "CSAFPID-5155187", "CSAFPID-5155188", "CSAFPID-5155189", "CSAFPID-5155190", "CSAFPID-5155191", "CSAFPID-5155192", "CSAFPID-5155193", "CSAFPID-5155194", "CSAFPID-5155195", "CSAFPID-5155196", "CSAFPID-5155197", "CSAFPID-5155198", "CSAFPID-5155199", "CSAFPID-5155200", "CSAFPID-5155201", "CSAFPID-5155202", "CSAFPID-5155203", "CSAFPID-5155204", "CSAFPID-5155205", "CSAFPID-5155206", "CSAFPID-5155207", "CSAFPID-5155208", "CSAFPID-5155209", "CSAFPID-5155210", "CSAFPID-5155211", "CSAFPID-5155212", "CSAFPID-5155213", "CSAFPID-5155214", "CSAFPID-5155215", "CSAFPID-5155216", "CSAFPID-5155217", "CSAFPID-5155218", "CSAFPID-5155219", "CSAFPID-5155220", "CSAFPID-5155221", "CSAFPID-5155222", "CSAFPID-5155223", "CSAFPID-5155224", "CSAFPID-5155225", "CSAFPID-5155226", "CSAFPID-5155227", "CSAFPID-5155228", "CSAFPID-5155229", "CSAFPID-5155230", "CSAFPID-5155231", "CSAFPID-5155232", "CSAFPID-5155233", "CSAFPID-5155234", "CSAFPID-5155235", "CSAFPID-5155236", "CSAFPID-5155237", "CSAFPID-5155238", "CSAFPID-5155239", "CSAFPID-5155240", "CSAFPID-5155241", "CSAFPID-5155242", "CSAFPID-5155243", "CSAFPID-5155244", "CSAFPID-5155245", "CSAFPID-5168230", "CSAFPID-5168231", "CSAFPID-5168232", "CSAFPID-5168233", "CSAFPID-5168234", "CSAFPID-5175079", "CSAFPID-5175080", "CSAFPID-5175081", "CSAFPID-5175082", "CSAFPID-5175083", "CSAFPID-5175084", "CSAFPID-5175085", "CSAFPID-5175086", "CSAFPID-5175087", "CSAFPID-5175088", "CSAFPID-5175089", "CSAFPID-5175090", "CSAFPID-5175091", "CSAFPID-5763733", "CSAFPID-5765240", "CSAFPID-5765241", "CSAFPID-5765242", "CSAFPID-5765243", "CSAFPID-5765244", "CSAFPID-5765245", "CSAFPID-5765246", "CSAFPID-5765247", "CSAFPID-5765248", "CSAFPID-5765249", "CSAFPID-5765250", "CSAFPID-5765251", "CSAFPID-5765252", "CSAFPID-5765253", "CSAFPID-5765254", "CSAFPID-5765255", "CSAFPID-5765256", "CSAFPID-5765257", "CSAFPID-5765258", "CSAFPID-5765259", "CSAFPID-5765260", "CSAFPID-5765261", "CSAFPID-5765262", "CSAFPID-5765263", "CSAFPID-5765264", "CSAFPID-5765265", "CSAFPID-5765266", "CSAFPID-5765267", "CSAFPID-5765268", "CSAFPID-5765269", "CSAFPID-5765270", "CSAFPID-5765271", "CSAFPID-5765272", "CSAFPID-5765273", "CSAFPID-5765274", "CSAFPID-5765275", "CSAFPID-5765276", "CSAFPID-5765277", "CSAFPID-5765278", "CSAFPID-5765279", "CSAFPID-5765280", "CSAFPID-5765281", "CSAFPID-5765282", "CSAFPID-5765283", "CSAFPID-5765284", "CSAFPID-5765285", "CSAFPID-5765286", "CSAFPID-5765287", "CSAFPID-5765288", "CSAFPID-5765289", "CSAFPID-5765290", "CSAFPID-5765291", "CSAFPID-5765292", "CSAFPID-5765293", "CSAFPID-5765294", "CSAFPID-5765295", "CSAFPID-5765296", "CSAFPID-5765297", "CSAFPID-5765298", "CSAFPID-5765299", "CSAFPID-5765300", "CSAFPID-5765301", "CSAFPID-5765302", "CSAFPID-5765303", "CSAFPID-5765304", "CSAFPID-5765305", "CSAFPID-5765306", "CSAFPID-5765307", "CSAFPID-5765308", "CSAFPID-5765309", "CSAFPID-5765310", "CSAFPID-5765311", "CSAFPID-5765312", "CSAFPID-5765313", "CSAFPID-5765314", "CSAFPID-5765315", "CSAFPID-5765316", "CSAFPID-5765317", "CSAFPID-5765318", "CSAFPID-5772274", "CSAFPID-5772275" ] } ], "title": "CVE-2026-28277" } ] }