{"data":{"id":"08ad94e2-e94b-4f60-b105-58f83cccd2c2","title":"GHSA-g48c-2wqr-h844: LangGraph checkpoint loading has unsafe msgpack deserialization","summary":"LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. An attacker who can write attacker-controlled checkpoint bytes to the backing store, for example after a database compromise, may supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded, potentially leading to code execution in the application runtime. The source states there is no evidence of exploitation in the wild.","solution":"LANGGRAPH_STRICT_MSGPACK: when set to a truthy value (1, true, yes), the default msgpack deserialization policy becomes strict, so JsonPlusSerializer() defaults allowed_msgpack_modules to None instead of True unless allowed_msgpack_modules is explicitly passed. Set allowed_msgpack_modules to None for strict mode, which reconstructs only a built-in safe set, or to a list of (module, class_name) tuples to allow exactly the listed symbols in addition to that set. When strict mode is enabled and a StateGraph is compiled, LangGraph derives an allowlist from the graph's schemas and channels and applies it to the checkpointer.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-g48c-2wqr-h844","publishedAt":"2026-03-05T20:19:49.000Z","cveId":"CVE-2026-28277","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["langgraph@<= 1.0.9"],"affectedPackageNames":["langgraph"],"affectedPackageRefs":["pypi:langgraph"],"affectedVendors":[],"affectedVendorsRaw":["LangGraph","LangChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0549,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-g48c-2wqr-h844"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}