@langchain mongodb vulnerabilities

Latest @langchain mongodb CVEs

Newest publication first

1. CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

   Published 2026-10-06

   Medium·CVSS 6.0 EPSS 0.46%

   LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.