Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@langchain/mongodb

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.0npmAmendedPublished

    LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

    CVE-2026-106119 · GHSA-m6rx-h84q-8r95

    Affected
    • npm @langchain/mongodb <= 1.3.0
    Fixed in
    1.3.1· Vendor fix available
    Issue
    Impact MongoDBChatMessageHistory did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier. Applications are affected when they pass untrusted session identifier input to MongoDBChatMessageHistory and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation. Applications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path. Patches The issue is fixed in @langchain/mongodb version 1.3.1. Users of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries. Workarounds If an immediate upgrade is…

    Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →