Langgraph Sdk
Monthly
Path traversal in the LangGraph Python SDK (langgraph-sdk 0.4.0 through 0.4.5, and langgraph 1.2.3 through 1.2.13 via RemoteGraph v3 streaming) lets an attacker who controls a streaming thread_id or assistant_id value redirect the SDK's authenticated GET requests to a different readable path on the same configured LangGraph server, with thread_id also able to inject query parameters such as /store/items?namespace=...&key=... . Exploitation requires the application to pass attacker-controlled text directly as those identifiers; requests are GET-only, so the impact is limited to disclosure of another readable path's response (CVSS 4.3, PR:L - authenticated), and the hosted LangGraph Platform is not exposed. The vendor has released fixed versions langgraph-sdk 0.4.6 and langgraph 1.2.14, and no public exploit code was identified at time of analysis.
Path traversal in the LangGraph Python SDK (langgraph-sdk 0.4.0 through 0.4.5, and langgraph 1.2.3 through 1.2.13 via RemoteGraph v3 streaming) lets an attacker who controls a streaming thread_id or assistant_id value redirect the SDK's authenticated GET requests to a different readable path on the same configured LangGraph server, with thread_id also able to inject query parameters such as /store/items?namespace=...&key=... . Exploitation requires the application to pass attacker-controlled text directly as those identifiers; requests are GET-only, so the impact is limited to disclosure of another readable path's response (CVSS 4.3, PR:L - authenticated), and the hosted LangGraph Platform is not exposed. The vendor has released fixed versions langgraph-sdk 0.4.6 and langgraph 1.2.14, and no public exploit code was identified at time of analysis.