langgraph 1.2.13

Direct Vulnerabilities

Known vulnerabilities in the langgraph package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Directory Traversal langgraph is a Building stateful, multi-actor applications with LLMs Affected versions of this package are vulnerable to Directory Traversal via unencoded `thread_id` and `assistant_id` interpolated directly into REST request paths in `_async/stream.py` and `_sync/stream.py`. The `_fetch_state` method builds `/threads/{thread_id}/state` and `get_tree` builds `/assistants/{assistant_id}/graph` without percent-encoding the supplied identifiers. Because httpx collapses `..` segments and treats `#` as a fragment boundary, an attacker who controls either identifier can cause the client to send requests to a different API path than intended, potentially accessing unintended resources or bypassing path-based access controls. Note: This is only exploitable if the application passes attacker-controlled text as a streaming `thread_id` or `assistant_id`. How to fix Directory Traversal? Upgrade `langgraph` to version 1.2.14 or higher.	[1.2.3,1.2.14)
L Authorization Bypass Through User-Controlled Key langgraph is a Building stateful, multi-actor applications with LLMs Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to a key collision in the `default_cache_key()` and `_freeze()` functions of `langgraph/_internal/_cache.py`, where `_freeze()` reduces a non-hashable object to `(type_name, tobytes_output, shape)` and drops distinguishing metadata such as numpy dtype and PIL image mode, size, and palette. An attacker can poison the result cache or obtain another user's cached result by submitting a numpy array or PIL image keyword argument that matches a victim's input byte-for-byte but differs in the dropped metadata, yielding an identical cache key. Exploitation requires the Functional API (`@task` or `@entrypoint`) called with keyword arguments, a `CachePolicy` using the default key function, a non-hashable argument exposing `.tobytes()`, and a shared or persistent cache in a multi-user deployment, while positional arguments are unaffected because a hashable tuple short-circuits the lossy branch. How to fix Authorization Bypass Through User-Controlled Key? A fix was pushed into the `master` branch but not yet published.	[0,)

Vulnerability

Vulnerable Version

Directory Traversal

langgraph is a Building stateful, multi-actor applications with LLMs

Affected versions of this package are vulnerable to Directory Traversal via unencoded thread_id and assistant_id interpolated directly into REST request paths in _async/stream.py and _sync/stream.py. The _fetch_state method builds /threads/{thread_id}/state and get_tree builds /assistants/{assistant_id}/graph without percent-encoding the supplied identifiers. Because httpx collapses .. segments and treats # as a fragment boundary, an attacker who controls either identifier can cause the client to send requests to a different API path than intended, potentially accessing unintended resources or bypassing path-based access controls.

Note: This is only exploitable if the application passes attacker-controlled text as a streaming thread_id or assistant_id.

How to fix Directory Traversal?

Upgrade langgraph to version 1.2.14 or higher.

[1.2.3,1.2.14)

Authorization Bypass Through User-Controlled Key

langgraph is a Building stateful, multi-actor applications with LLMs

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to a key collision in the default_cache_key() and _freeze() functions of langgraph/_internal/_cache.py, where _freeze() reduces a non-hashable object to (type_name, tobytes_output, shape) and drops distinguishing metadata such as numpy dtype and PIL image mode, size, and palette. An attacker can poison the result cache or obtain another user's cached result by submitting a numpy array or PIL image keyword argument that matches a victim's input byte-for-byte but differs in the dropped metadata, yielding an identical cache key. Exploitation requires the Functional API (@task or @entrypoint) called with keyword arguments, a CachePolicy using the default key function, a non-hashable argument exposing .tobytes(), and a shared or persistent cache in a multi-user deployment, while positional arguments are unaffected because a hashable tuple short-circuits the lossy branch.

How to fix Authorization Bypass Through User-Controlled Key?

A fix was pushed into the master branch but not yet published.

[0,)

langgraph@1.2.13

Building stateful, multi-actor applications with LLMs

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically