{"data":{"ecosystem":"pypi","name":"langgraph-checkpoint","url":"https://aisecwatch.com/packages/pypi/langgraph-checkpoint","latestVersion":"4.2.0","firstReleaseAt":"2024-08-02T23:03:10.240Z","repository":"https://github.com/langchain-ai/langgraph/tree/main/libs/checkpoint","llm":{"exposure":"direct","depth":0,"integratedAt":"2024-08-02T23:03:10.240Z","integratedVersion":"1.0.0","sdks":["langgraph"],"path":[]},"authority":{"profile":[],"fromDependencies":[]},"dependencies":[{"ecosystem":"pypi","name":"langchain-core","versionSpec":">=0.2.38","scope":"runtime"},{"ecosystem":"pypi","name":"ormsgpack","versionSpec":">=1.12.0","scope":"runtime"}],"advisories":[{"id":"8fa3ded4-3ebc-4093-a713-5120334b7a47","url":"https://aisecwatch.com/issues/8fa3ded4-3ebc-4093-a713-5120334b7a47","cveId":"CVE-2026-48775","title":"GHSA-fjqc-hq36-qh5p: LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading","headline":null,"severity":"medium","publishedAt":"2026-06-25T18:25:42.000Z","affected":["langgraph-checkpoint@< 4.1.1 (fixed: 4.1.1)"],"epssScore":0.00685,"matchedBy":"ecosystem"},{"id":"770cb231-cea6-47f3-a439-e4d66214e192","url":"https://aisecwatch.com/issues/770cb231-cea6-47f3-a439-e4d66214e192","cveId":"CVE-2026-27794","title":"GHSA-mhr3-j7m5-c7c9: LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution ","headline":null,"severity":"medium","publishedAt":"2026-02-25T22:59:12.000Z","affected":["langgraph-checkpoint@< 4.0.0 (fixed: 4.0.0)"],"epssScore":0.0096,"matchedBy":"ecosystem"},{"id":"eeb76820-77ae-489f-8c31-22c9f65cc42c","url":"https://aisecwatch.com/issues/eeb76820-77ae-489f-8c31-22c9f65cc42c","cveId":"CVE-2025-64439","title":"GHSA-wwqv-p2pp-99h5: LangGraph Checkpoint affected by RCE in \"json\" mode of JsonPlusSerializer ","headline":null,"severity":"high","publishedAt":"2025-11-05T19:52:50.000Z","affected":["langgraph-checkpoint@< 3.0.0 (fixed: 3.0.0)"],"epssScore":0.00887,"matchedBy":"ecosystem"}],"checkedAt":"2026-10-09T21:51:15.841Z"},"meta":{"advisoryMatching":"by package name and ecosystem; an advisory with no ecosystem recorded for the package is matched by name alone"}}