LangGraph GHSA-6hmw-9432-67qq tuple namespace collision

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsLangGraph dotted namespace serialization crossed tenant store boundaries: Maintainers list fixed releases langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.

  Affected and patched versions

• supportsLangGraph dotted namespace serialization crossed tenant store boundaries: GHSA-6hmw-9432-67qq shows that Postgres and SQLite stores map ("tenant", "bob") and ("tenant.bob",) to the same persisted namespace and patched different versions 3.1.3 and 3.1.2 respectively.

  Summary; Details; Impact; Remediation

• supportsLangGraph dotted namespace serialization crossed tenant store boundaries: The advisory demonstrates that ("tenant.bob",) and ("tenant", "bob") collided in Postgres/SQLite serialization, with unchecked get, search, delete and batch routes; InMemoryStore was not affected.

  Summary; Details; Impact