langchain-ai langgraph
11 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118667 | >= 1.2.3, < 1.2.14 | LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests | MEDIUM 4.3 | |||
| CVE-2026-115885 | >= 0.4.15, < 0.4.32 | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output | MEDIUM 4.1 | 0.1 % | ||
| CVE-2026-115883 | < 1.2.15 | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-104873 | >= 0.1.45, < 0.4.4 | LangGraph SDK custom auth silently ignores actions= on resource decorators | HIGH 7.6 | 0.3 % | ||
| CVE-2026-71433 | < 3.1.1 | LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-14742 | 1.2.0 ; 1.2.1 ; 1.2.2 ; … | langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash | LOW 2.3 | 0.2 % | ||
| CVE-2026-48775 | < 1.2.2 | LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-28277 | <= 1.0.9 | LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading | HIGH 7.2 | 4.9 % | ||
| CVE-2025-67644 | < 3.0.1 | LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method | HIGH 7.8 | 2.3 % | ||
| CVE-2025-64439 | < 3.0.0 | LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer | HIGH 7.4 | 0.9 % | ||
| CVE-2025-64104 | < 2.0.11 | LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore | HIGH 7.3 | 0.2 % |