Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
GHSA-533J-2V4Q-MW5H
Vulnerability from github – Published: 2026-08-20 17:29 – Updated: 2026-08-20 17:29
VLAI
Summary
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Details
Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.
CVSS Details
CVSS 4.0
| Field | Value |
|---|---|
| CVSS Version | 4.0 |
| Vector String | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| Base Score | 7.1 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector (AV) | Network | Triggerable remotely via API |
| Attack Complexity (AC) | Low | No special conditions required |
| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |
| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |
| User Interaction (UI) | None | No user action required |
| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |
| Vulnerable System Integrity (VI) | None | Read-only access |
| Vulnerable System Availability (VA) | None | No service disruption |
| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |
| Subsequent System Integrity (SI) | None | No write or modification capability |
| Subsequent System Availability (SA) | None | No service disruption to downstream systems |
CVSS 3.1
| Field | Value |
|---|---|
| CVSS Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Base Score | 7.7 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Triggerable remotely via API |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated caller of the checkpoint/store API |
| User Interaction | None | No user action required |
| Scope | Changed | Impact crosses tenant boundaries |
| Confidentiality | High | Full access to other tenants' checkpoint data |
| Integrity | None | Read-only access |
| Availability | None | No service disruption |
| --- | ||
| ## Affected Packages | ||
| Package | Distribution | Affected Methods |
| --- | --- | --- |
langgraph-checkpoint-mongodb |
PyPI | MongoDBSaver.list(), MongoDBSaver.alist() |
langgraph-store-mongodb |
PyPI | MongoDBStore.search() |
| --- | ||
| ## Advisory FAQ | ||
| ### How do I know if I am affected? |
You are likely affected if all of the following are true:
1. Your application uses langgraph-checkpoint-mongodb or langgraph-store-mongodb.
2. Your application calls MongoDBSaver.list(), MongoDBSaver.alist(), or
MongoDBStore.search() with a filter argument.
3. Any part of that filter argument is derived from user-controlled input — for example, HTTP
query parameters, request body fields, or agent tool arguments.
4. You operate in a multi-tenant context where the filter is used to enforce per-user or
per-tenant data isolation.
If the filter argument is constructed entirely from trusted, server-side values, the practical risk is
lower, but upgrading is still recommended.
How do I fix the issue?
Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb.
If you cannot upgrade immediately, apply the following mitigation: in your application code,
before passing any user-controlled input to the filter parameter, remove or escape MongoDB
Query metacharacters such as “$”.
Acknowledgements
Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.
Revisions
| Date | Description |
|---|---|
| 2026-06-05 | Initial advisory published |
Severity
7.7 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langgraph-checkpoint-mongodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "langgraph-store-mongodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55253"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-20T17:29:14Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# Executive Summary\n\nA NoSQL injection issue exists in the langgraph-checkpoint-mongodb and\nlanggraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods\naccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.\nBecause MongoDB query operator keys (those prefixed with $) are not rejected during filter\nconstruction, a caller with control of the filter input can embed MongoDB query operators\ndirectly into the query.\n\n---\n\n## CVSS Details\n\n### CVSS 4.0\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 4.0 |\n| **Vector String** | `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N` |\n| **Base Score** | **7.1 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector (AV) | Network | Triggerable remotely via API |\n| Attack Complexity (AC) | Low | No special conditions required |\n| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |\n| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction (UI) | None | No user action required |\n| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |\n| Vulnerable System Integrity (VI) | None | Read-only access |\n| Vulnerable System Availability (VA) | None | No service disruption |\n| Subsequent System Confidentiality (SC) | High | Full access to other tenants\u0027 checkpoint data |\n| Subsequent System Integrity (SI) | None | No write or modification capability |\n| Subsequent System Availability (SA) | None | No service disruption to downstream systems |\n\n### CVSS 3.1\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 3.1 |\n| **Vector String** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N` |\n| **Base Score** | **7.7 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector | Network | Triggerable remotely via API |\n| Attack Complexity | Low | No special conditions required |\n| Privileges Required | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction | None | No user action required |\n| Scope | Changed | Impact crosses tenant boundaries |\n| Confidentiality | High | Full access to other tenants\u0027 checkpoint data |\n| Integrity | None | Read-only access |\n| Availability | None | No service disruption |\n---\n## Affected Packages\n| Package | Distribution | Affected Methods | Affected Versions |\n|---|---|---|---|\n| `langgraph-checkpoint-mongodb` | PyPI | `MongoDBSaver.list()`, `MongoDBSaver.alist()` | \u003c 0.3.0 |\n| `langgraph-store-mongodb` | PyPI | `MongoDBStore.search()` | \u003c 0.4.0 |\n---\n## Advisory FAQ\n### How do I know if I am affected?\n\nYou are likely affected if **all** of the following are true:\n1. Your application uses `langgraph-checkpoint-mongodb` or `langgraph-store-mongodb`.\n2. Your application calls `MongoDBSaver.list()`, `MongoDBSaver.alist()`, or\n`MongoDBStore.search()` with a `filter` argument.\n3. Any part of that `filter` argument is derived from user-controlled input \u2014 for example, HTTP\nquery parameters, request body fields, or agent tool arguments.\n4. You operate in a multi-tenant context where the `filter` is used to enforce per-user or\nper-tenant data isolation.\n\nIf the `filter` argument is constructed entirely from trusted, server-side values, the practical risk is\nlower, but upgrading is still recommended.\n\n### How do I fix the issue?\n\n**Upgrade** to the version of `langgraph-checkpoint-mongodb` and `langgraph-store-mongodb`.\nIf you cannot upgrade immediately, apply the following mitigation: in your application code,\nbefore passing any user-controlled input to the `filter` parameter, remove or escape MongoDB\nQuery metacharacters such as \u201c$\u201d.\n\n---\n\n## Acknowledgements\nThanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security\nAdvisory program on the langchain-mongodb repository.\n\n---\n\n## Revisions\n\n| Date | Description |\n|---|---|\n| 2026-06-05 | Initial advisory published |",
"id": "GHSA-533j-2v4q-mw5h",
"modified": "2026-08-20T17:29:14Z",
"published": "2026-08-20T17:29:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langchain-mongodb"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure"
}
PYSEC-2026-3859
Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02
VLAI
Details
Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.
CVSS Details
CVSS 4.0
| Field | Value |
|---|---|
| CVSS Version | 4.0 |
| Vector String | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| Base Score | 7.1 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector (AV) | Network | Triggerable remotely via API |
| Attack Complexity (AC) | Low | No special conditions required |
| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |
| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |
| User Interaction (UI) | None | No user action required |
| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |
| Vulnerable System Integrity (VI) | None | Read-only access |
| Vulnerable System Availability (VA) | None | No service disruption |
| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |
| Subsequent System Integrity (SI) | None | No write or modification capability |
| Subsequent System Availability (SA) | None | No service disruption to downstream systems |
CVSS 3.1
| Field | Value |
|---|---|
| CVSS Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Base Score | 7.7 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Triggerable remotely via API |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated caller of the checkpoint/store API |
| User Interaction | None | No user action required |
| Scope | Changed | Impact crosses tenant boundaries |
| Confidentiality | High | Full access to other tenants' checkpoint data |
| Integrity | None | Read-only access |
| Availability | None | No service disruption |
| --- | ||
| ## Affected Packages | ||
| Package | Distribution | Affected Methods |
| --- | --- | --- |
langgraph-checkpoint-mongodb |
PyPI | MongoDBSaver.list(), MongoDBSaver.alist() |
langgraph-store-mongodb |
PyPI | MongoDBStore.search() |
| --- | ||
| ## Advisory FAQ | ||
| ### How do I know if I am affected? |
You are likely affected if all of the following are true:
1. Your application uses langgraph-checkpoint-mongodb or langgraph-store-mongodb.
2. Your application calls MongoDBSaver.list(), MongoDBSaver.alist(), or
MongoDBStore.search() with a filter argument.
3. Any part of that filter argument is derived from user-controlled input — for example, HTTP
query parameters, request body fields, or agent tool arguments.
4. You operate in a multi-tenant context where the filter is used to enforce per-user or
per-tenant data isolation.
If the filter argument is constructed entirely from trusted, server-side values, the practical risk is
lower, but upgrading is still recommended.
How do I fix the issue?
Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb.
If you cannot upgrade immediately, apply the following mitigation: in your application code,
before passing any user-controlled input to the filter parameter, remove or escape MongoDB
Query metacharacters such as “$”.
Acknowledgements
Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.
Revisions
| Date | Description |
|---|---|
| 2026-06-05 | Initial advisory published |
Severity
7.7 (High)
Impacted products
| Name | purl | langgraph-checkpoint-mongodb | pkg:pypi/langgraph-checkpoint-mongodb |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langgraph-checkpoint-mongodb",
"purl": "pkg:pypi/langgraph-checkpoint-mongodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"0.1.0a0",
"0.1.0a1",
"0.1.0a3",
"0.1.1",
"0.1.2",
"0.1.3",
"0.1.4",
"0.2.0",
"0.2.1",
"0.2.2"
]
}
],
"aliases": [
"CVE-2026-55253",
"GHSA-533j-2v4q-mw5h"
],
"details": "# Executive Summary\n\nA NoSQL injection issue exists in the langgraph-checkpoint-mongodb and\nlanggraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods\naccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.\nBecause MongoDB query operator keys (those prefixed with $) are not rejected during filter\nconstruction, a caller with control of the filter input can embed MongoDB query operators\ndirectly into the query.\n\n---\n\n## CVSS Details\n\n### CVSS 4.0\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 4.0 |\n| **Vector String** | `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N` |\n| **Base Score** | **7.1 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector (AV) | Network | Triggerable remotely via API |\n| Attack Complexity (AC) | Low | No special conditions required |\n| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |\n| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction (UI) | None | No user action required |\n| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |\n| Vulnerable System Integrity (VI) | None | Read-only access |\n| Vulnerable System Availability (VA) | None | No service disruption |\n| Subsequent System Confidentiality (SC) | High | Full access to other tenants\u0027 checkpoint data |\n| Subsequent System Integrity (SI) | None | No write or modification capability |\n| Subsequent System Availability (SA) | None | No service disruption to downstream systems |\n\n### CVSS 3.1\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 3.1 |\n| **Vector String** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N` |\n| **Base Score** | **7.7 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector | Network | Triggerable remotely via API |\n| Attack Complexity | Low | No special conditions required |\n| Privileges Required | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction | None | No user action required |\n| Scope | Changed | Impact crosses tenant boundaries |\n| Confidentiality | High | Full access to other tenants\u0027 checkpoint data |\n| Integrity | None | Read-only access |\n| Availability | None | No service disruption |\n---\n## Affected Packages\n| Package | Distribution | Affected Methods | Affected Versions |\n|---|---|---|---|\n| `langgraph-checkpoint-mongodb` | PyPI | `MongoDBSaver.list()`, `MongoDBSaver.alist()` | \u003c 0.3.0 |\n| `langgraph-store-mongodb` | PyPI | `MongoDBStore.search()` | \u003c 0.4.0 |\n---\n## Advisory FAQ\n### How do I know if I am affected?\n\nYou are likely affected if **all** of the following are true:\n1. Your application uses `langgraph-checkpoint-mongodb` or `langgraph-store-mongodb`.\n2. Your application calls `MongoDBSaver.list()`, `MongoDBSaver.alist()`, or\n`MongoDBStore.search()` with a `filter` argument.\n3. Any part of that `filter` argument is derived from user-controlled input \u2014 for example, HTTP\nquery parameters, request body fields, or agent tool arguments.\n4. You operate in a multi-tenant context where the `filter` is used to enforce per-user or\nper-tenant data isolation.\n\nIf the `filter` argument is constructed entirely from trusted, server-side values, the practical risk is\nlower, but upgrading is still recommended.\n\n### How do I fix the issue?\n\n**Upgrade** to the version of `langgraph-checkpoint-mongodb` and `langgraph-store-mongodb`.\nIf you cannot upgrade immediately, apply the following mitigation: in your application code,\nbefore passing any user-controlled input to the `filter` parameter, remove or escape MongoDB\nQuery metacharacters such as \u201c$\u201d.\n\n---\n\n## Acknowledgements\nThanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security\nAdvisory program on the langchain-mongodb repository.\n\n---\n\n## Revisions\n\n| Date | Description |\n|---|---|\n| 2026-06-05 | Initial advisory published |",
"id": "PYSEC-2026-3859",
"modified": "2026-09-10T11:02:12.131403Z",
"published": "2026-09-10T09:44:52.155128Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langchain-mongodb"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/langgraph-checkpoint-mongodb"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-533j-2v4q-mw5h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55253"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure"
}
PYSEC-2026-3860
Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02
VLAI
Details
Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.
CVSS Details
CVSS 4.0
| Field | Value |
|---|---|
| CVSS Version | 4.0 |
| Vector String | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| Base Score | 7.1 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector (AV) | Network | Triggerable remotely via API |
| Attack Complexity (AC) | Low | No special conditions required |
| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |
| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |
| User Interaction (UI) | None | No user action required |
| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |
| Vulnerable System Integrity (VI) | None | Read-only access |
| Vulnerable System Availability (VA) | None | No service disruption |
| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |
| Subsequent System Integrity (SI) | None | No write or modification capability |
| Subsequent System Availability (SA) | None | No service disruption to downstream systems |
CVSS 3.1
| Field | Value |
|---|---|
| CVSS Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Base Score | 7.7 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Triggerable remotely via API |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated caller of the checkpoint/store API |
| User Interaction | None | No user action required |
| Scope | Changed | Impact crosses tenant boundaries |
| Confidentiality | High | Full access to other tenants' checkpoint data |
| Integrity | None | Read-only access |
| Availability | None | No service disruption |
| --- | ||
| ## Affected Packages | ||
| Package | Distribution | Affected Methods |
| --- | --- | --- |
langgraph-checkpoint-mongodb |
PyPI | MongoDBSaver.list(), MongoDBSaver.alist() |
langgraph-store-mongodb |
PyPI | MongoDBStore.search() |
| --- | ||
| ## Advisory FAQ | ||
| ### How do I know if I am affected? |
You are likely affected if all of the following are true:
1. Your application uses langgraph-checkpoint-mongodb or langgraph-store-mongodb.
2. Your application calls MongoDBSaver.list(), MongoDBSaver.alist(), or
MongoDBStore.search() with a filter argument.
3. Any part of that filter argument is derived from user-controlled input — for example, HTTP
query parameters, request body fields, or agent tool arguments.
4. You operate in a multi-tenant context where the filter is used to enforce per-user or
per-tenant data isolation.
If the filter argument is constructed entirely from trusted, server-side values, the practical risk is
lower, but upgrading is still recommended.
How do I fix the issue?
Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb.
If you cannot upgrade immediately, apply the following mitigation: in your application code,
before passing any user-controlled input to the filter parameter, remove or escape MongoDB
Query metacharacters such as “$”.
Acknowledgements
Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.
Revisions
| Date | Description |
|---|---|
| 2026-06-05 | Initial advisory published |
Severity
7.7 (High)
Impacted products
| Name | purl | langgraph-store-mongodb | pkg:pypi/langgraph-store-mongodb |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langgraph-store-mongodb",
"purl": "pkg:pypi/langgraph-store-mongodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.1.0",
"0.1.1",
"0.2.0",
"0.3.0"
]
}
],
"aliases": [
"CVE-2026-55253",
"GHSA-533j-2v4q-mw5h"
],
"details": "# Executive Summary\n\nA NoSQL injection issue exists in the langgraph-checkpoint-mongodb and\nlanggraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods\naccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.\nBecause MongoDB query operator keys (those prefixed with $) are not rejected during filter\nconstruction, a caller with control of the filter input can embed MongoDB query operators\ndirectly into the query.\n\n---\n\n## CVSS Details\n\n### CVSS 4.0\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 4.0 |\n| **Vector String** | `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N` |\n| **Base Score** | **7.1 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector (AV) | Network | Triggerable remotely via API |\n| Attack Complexity (AC) | Low | No special conditions required |\n| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |\n| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction (UI) | None | No user action required |\n| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |\n| Vulnerable System Integrity (VI) | None | Read-only access |\n| Vulnerable System Availability (VA) | None | No service disruption |\n| Subsequent System Confidentiality (SC) | High | Full access to other tenants\u0027 checkpoint data |\n| Subsequent System Integrity (SI) | None | No write or modification capability |\n| Subsequent System Availability (SA) | None | No service disruption to downstream systems |\n\n### CVSS 3.1\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 3.1 |\n| **Vector String** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N` |\n| **Base Score** | **7.7 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector | Network | Triggerable remotely via API |\n| Attack Complexity | Low | No special conditions required |\n| Privileges Required | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction | None | No user action required |\n| Scope | Changed | Impact crosses tenant boundaries |\n| Confidentiality | High | Full access to other tenants\u0027 checkpoint data |\n| Integrity | None | Read-only access |\n| Availability | None | No service disruption |\n---\n## Affected Packages\n| Package | Distribution | Affected Methods | Affected Versions |\n|---|---|---|---|\n| `langgraph-checkpoint-mongodb` | PyPI | `MongoDBSaver.list()`, `MongoDBSaver.alist()` | \u003c 0.3.0 |\n| `langgraph-store-mongodb` | PyPI | `MongoDBStore.search()` | \u003c 0.4.0 |\n---\n## Advisory FAQ\n### How do I know if I am affected?\n\nYou are likely affected if **all** of the following are true:\n1. Your application uses `langgraph-checkpoint-mongodb` or `langgraph-store-mongodb`.\n2. Your application calls `MongoDBSaver.list()`, `MongoDBSaver.alist()`, or\n`MongoDBStore.search()` with a `filter` argument.\n3. Any part of that `filter` argument is derived from user-controlled input \u2014 for example, HTTP\nquery parameters, request body fields, or agent tool arguments.\n4. You operate in a multi-tenant context where the `filter` is used to enforce per-user or\nper-tenant data isolation.\n\nIf the `filter` argument is constructed entirely from trusted, server-side values, the practical risk is\nlower, but upgrading is still recommended.\n\n### How do I fix the issue?\n\n**Upgrade** to the version of `langgraph-checkpoint-mongodb` and `langgraph-store-mongodb`.\nIf you cannot upgrade immediately, apply the following mitigation: in your application code,\nbefore passing any user-controlled input to the `filter` parameter, remove or escape MongoDB\nQuery metacharacters such as \u201c$\u201d.\n\n---\n\n## Acknowledgements\nThanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security\nAdvisory program on the langchain-mongodb repository.\n\n---\n\n## Revisions\n\n| Date | Description |\n|---|---|\n| 2026-06-05 | Initial advisory published |",
"id": "PYSEC-2026-3860",
"modified": "2026-09-10T11:02:12.466783Z",
"published": "2026-09-10T09:44:52.300898Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langchain-mongodb"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/langgraph-store-mongodb"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-533j-2v4q-mw5h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55253"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure"
}