{"answers":{"affected":"4 open source packages ship an affected version, including langgraph-sdk and langgraph. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-48776 in the wild and no public exploit code.","fix":"Upgrade langgraph-sdk to 0.3.15 or later.","what":"CVE-2026-48776 is a medium-severity path traversal vulnerability in langchain-ai, published on 16 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-48776 and fix it if it is affected.\n\nWhat it is: CVE-2026-48776 is a medium-severity path traversal vulnerability in langchain-ai, published on 16 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-48776 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- langgraph-sdk (PyPI): affected all versions; fixed in 0.3.15\n- langgraph-sdk (PyPI): affected all versions; fixed in 0.3.15\n- langgraph-sdk (PyPI): affected all versions; fixed in 0.3.15\n- langgraph (PyPI): affected all versions; fixed in 0.3.15\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-48776/ (Markdown: https://insights.sbomify.com/CVE-2026-48776/index.md)","id":"CVE-2026-48776","markdown":"https://insights.sbomify.com/CVE-2026-48776/index.md","name":"CVE-2026-48776","record":{"aliases":["GHSA-w39p-vh2g-g8g5","PYSEC-2026-2194","PYSEC-2026-2575","ROOT-APP-PYPI-CVE-2026-48776"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["privilege_escalation","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"LangGraph Python SDK","requires_auth":"low_privilege","summary":"Attackers can manipulate URL paths to access or modify unauthorized resources if untrusted identifiers are passed to the LangGraph SDK without validation.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"langgraph-sdk","vendor":"langchain"}],"cvss":{"score":4.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to address a different resource (and potentially a different resource type) than the SDK method's call site indicates. In deployments where the SDK receives identifier values that originate from untrusted sources, this could result in unintended access, modification, or deletion of resources beyond the calling user's authorization scope. This issue is most consequential in deployments that forward end-user-supplied values directly into SDK identifier parameters without first validating them against an expected format (such as a UUID), and rely on URL-prefix-based authorization at an upstream layer (reverse proxy, edge gateway, WAF), where the authorization decision is made on the SDK call's intended path rather than on the final delivered request path. The issue has been fixed in version 0.3.15.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"LangGraph SDK has unsafe URL path construction","id":"CVE-2026-48776","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":4,"n_references":2,"next":{"headline":"FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory","id":"CVE-2026-48777"},"packages":[{"ecosystem":"PyPI","fixed":["0.3.15"],"introduced":["0"],"last_affected":[],"package":"langgraph","purl":"pkg:pypi/langgraph","source":"PYSEC-2026-2194"},{"ecosystem":"PyPI","fixed":["0.3.15"],"introduced":["0"],"last_affected":[],"package":"langgraph-sdk","purl":null,"source":"GHSA-w39p-vh2g-g8g5"},{"ecosystem":"PyPI","fixed":["0.3.15"],"introduced":["0"],"last_affected":[],"package":"langgraph-sdk","purl":"pkg:pypi/langgraph-sdk","source":"GHSA-w39p-vh2g-g8g5"},{"ecosystem":"PyPI","fixed":["0.3.15"],"introduced":["0"],"last_affected":[],"package":"langgraph-sdk","purl":"pkg:pypi/langgraph-sdk","source":"PYSEC-2026-2575"}],"prev":{"headline":"LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading","id":"CVE-2026-48775"},"products":["langchain-ai","langchain-sdk"],"published":"2026-06-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-06-17","vendors":["langchain-ai"]},"summary":"Attackers can manipulate URL paths to access or modify unauthorized resources if untrusted identifiers are passed to the LangGraph SDK without validation.","url":"https://insights.sbomify.com/CVE-2026-48776/"}