PatchTheCEVCVE-2026-115883: LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and
21
Routine
MEDIUM 6.0
CVE-2026-115883 is a medium-severity flaw (CVSS 6.0) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_names
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Publisher (CNA): GitHub, Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.