https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:28:41.046486+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-28277 CVE-2026-28277 — LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading 2026-10-03T06:28:41.050006+00:00

Affected: langchain-ai langgraph

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.

 https://cve.radiocsirt.org/vuln/ghsa-g48c-2wqr-h844 GHSA-g48c-2wqr-h844 — LangGraph checkpoint loading has unsafe msgpack deserialization 2026-10-03T06:28:41.050068+00:00

Affected: PyPI: langgraph

LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded.

This is a **post-exploitation / defense-in-depth** issue. Exploitation requires the ability to write attacker-controlled checkpoint bytes at rest. In most deployments that prerequisite already implies a serious incident; the additional risk is turning “checkpoint-store write access” into code execution in the application runtime, which can expand blast radius (for example by exposing environment variables or cloud credentials available to the runtime).

There is no evidence of exploitation in the wild, and LangGraph is not aware of a practical exploitation path in existing deployments today. This change is intended to reduce the blast radius of a checkpoint-store compromise.

## Affected users / systems

Users may be affected if they:

- use a persistent checkpointer (database, remote store, shared filesystem, etc.), - load/resume from checkpoints, and - operate in an environment where an attacker could gain privileged write access to checkpoint data in the backing store.

This issue requires the attacker to be able to modify persisted checkpoint bytes (or to compromise a trusted…