LA
Product
langgraph
10
CVEs
0
On KEV
7.8
Max CVSS
3
New 30D
Severity mix
Critical 0High 5Medium 4Low 1
Watch
Add langgraph to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67644 | 7.8 | Dec 10 | LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method Affected: < 3.0.1 |
| CVE-2026-104873 | 7.6 | Oct 2 | LangGraph SDK custom auth silently ignores actions= on resource decorators Affected: >= 0.1.45, < 0.4.4 |
| CVE-2025-64439 | 7.4 | Nov 7 | LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer Affected: < 3.0.0 |
| CVE-2025-64104 | 7.3 | Oct 29 | LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore Affected: < 2.0.11 |
| CVE-2026-28277 | 7.2 | Mar 5 | LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading Affected: <= 1.0.9 |
| CVE-2026-48775 | 6.8 | Jun 16 | LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading Affected: < 1.2.2 |
| CVE-2026-115883 New | 6.0 | Oct 23 | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores Affected: < 1.2.15 |
| CVE-2026-71433 | 5.3 | Aug 6 | LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores Affected: < 3.1.1 |
| CVE-2026-115885 New | 4.1 | Oct 23 | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output Affected: >= 0.4.15, < 0.4.32 |
| CVE-2026-14742 | 3.1 | Jul 5 | langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4 |
Showing 10