Command Injection Vulnerability in LangGraph CLI by LangChain AI

CVE-2026-115885

What is CVE-2026-115885?

The LangGraph CLI, by LangChain AI, has a command injection vulnerability that allows the exposure of a temporary registry push token during the execution of the command 'langgraph deploy --verbose'. This token, present in standard input, is at risk of being logged in CI/CD logs or terminal recordings, potentially allowing unauthorized users to access deployment images or push unauthorized images within a maximum expiration period of 12 hours. Notably, deployments that utilize the command without the '--verbose' flag and remote image builds remain secure. The vulnerability is effectively addressed in version 0.4.32.

References