{"data":{"id":"1a7b1d9c-c83f-4d70-8dfc-1dabfc66f364","title":"GHSA-w39p-vh2g-g8g5: LangGraph SDK has unsafe URL path construction","summary":"The langgraph-sdk builds HTTP request paths by interpolating caller-supplied identifier values into URL templates without sanitization. Identifiers containing URL-special characters can address a different resource or resource type than the call site indicates, potentially exposing, modifying or deleting resources beyond the caller's authorization scope.","solution":"The SDK now applies path-segment encoding to identifier values before interpolation into request URL templates. Applications should also validate identifier values (typically as UUIDs) at the boundary where untrusted input enters the application, before passing them to SDK methods.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-w39p-vh2g-g8g5","publishedAt":"2026-06-25T18:32:35.000Z","cveId":"CVE-2026-48776","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langgraph-sdk@< 0.3.15 (fixed: 0.3.15)"],"affectedPackageNames":["langgraph-sdk"],"affectedPackageRefs":["pypi:langgraph-sdk"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangGraph SDK","langgraph-sdk","LangSmith"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00216,"epssCheckedAt":"2026-11-09T06:13:51.691Z","kevDateAdded":null,"advisoryAliases":["GHSA-w39p-vh2g-g8g5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-25T18:32:35.000Z","fixReleasedAt":"2026-05-22T16:54:26.013Z","daysToFix":-34,"fixCheckedAt":"2026-10-29T21:33:45.207Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langgraph-sdk","fixedVersion":"0.3.15","matchedVersion":"0.3.15","fixReleasedAt":"2026-05-22T16:54:26.013Z","daysToFix":-34,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:33:45.056Z"}]}}