{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106119", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T15:33:55.333Z", "datePublished": "2026-10-06T18:01:24.262Z", "dateUpdated": "2026-10-06T18:01:24.262Z"}, "containers": {"cna": {"title": "LangChain: MongoDBChatMessageHistory query injection can allow cross-session access", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95"}, {"name": "https://github.com/langchain-ai/langchainjs/pull/11672", "tags": ["x_refsource_MISC"], "url": "https://github.com/langchain-ai/langchainjs/pull/11672"}, {"name": "https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af", "tags": ["x_refsource_MISC"], "url": "https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af"}, {"name": "https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1"}], "affected": [{"vendor": "langchain-ai", "product": "langchainjs", "versions": [{"version": "< 1.5.14", "status": "affected"}]}, {"vendor": "@langchain", "product": "mongodb", "versions": [{"version": "< 1.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-06T18:01:24.262Z"}, "descriptions": [{"lang": "en", "value": "LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1."}], "source": {"advisory": "GHSA-m6rx-h84q-8r95", "discovery": "UNKNOWN"}}}}

{}

{}

{}

{}