CVE-2026-55253: Langgraph store mongodb LangChain MongoDB Has NoSQL Operator Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-533j-2v4q-mw5h",
  "modified" : "2026-08-20T17:29:14Z",
  "published" : "2026-08-20T17:29:14Z",
  "aliases" : [ "CVE-2026-55253" ],
  "summary" : "LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure",
  "details" : "# Executive Summary\n\nA NoSQL injection issue exists in the langgraph-checkpoint-mongodb and\nlanggraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods\naccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.\nBecause MongoDB query operator keys (those prefixed with $) are not rejected during filter\nconstruction, a caller with control of the filter input can embed MongoDB query operators\ndirectly into the query.\n\n---\n\n## CVSS Details\n\n### CVSS 4.0\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 4.0 |\n| **Vector String** | `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N` |\n| **Base Score** | **7.1 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector (AV) | Network | Triggerable remotely via API |\n| Attack Complexity (AC) | Low | No special conditions required |\n| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |\n| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction (UI) | None | No user action required |\n| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |\n| Vulnerable System Integrity (VI) | None | Read-only access |\n| Vulnerable System Availability (VA) | None | No service disruption |\n| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |\n| Subsequent System Integrity (SI) | None | No write or modification capability |\n| Subsequent System Availability (SA) | None | No service disruption to downstream systems |\n\n### CVSS 3.1\n\n| Field | Value |\n|---|---|\n| **CVSS Version** | 3.1 |\n| **Vector String** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N` |\n| **Base Score** | **7.7 (High)** |\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector | Network | Triggerable remotely via API |\n| Attack Complexity | Low | No special conditions required |\n| Privileges Required | Low | Authenticated caller of the checkpoint/store API |\n| User Interaction | None | No user action required |\n| Scope | Changed | Impact crosses tenant boundaries |\n| Confidentiality | High | Full access to other tenants' checkpoint data |\n| Integrity | None | Read-only access |\n| Availability | None | No service disruption |\n---\n## Affected Packages\n| Package | Distribution | Affected Methods | Affected Versions |\n|---|---|---|---|\n| `langgraph-checkpoint-mongodb` | PyPI | `MongoDBSaver.list()`, `MongoDBSaver.alist()` | < 0.3.0 |\n| `langgraph-store-mongodb` | PyPI | `MongoDBStore.search()` | < 0.4.0 |\n---\n## Advisory FAQ\n### How do I know if I am affected?\n\nYou are likely affected if **all** of the following are true:\n1. Your application uses `langgraph-checkpoint-mongodb` or `langgraph-store-mongodb`.\n2. Your application calls `MongoDBSaver.list()`, `MongoDBSaver.alist()`, or\n`MongoDBStore.search()` with a `filter` argument.\n3. Any part of that `filter` argument is derived from user-controlled input — for example, HTTP\nquery parameters, request body fields, or agent tool arguments.\n4. You operate in a multi-tenant context where the `filter` is used to enforce per-user or\nper-tenant data isolation.\n\nIf the `filter` argument is constructed entirely from trusted, server-side values, the practical risk is\nlower, but upgrading is still recommended.\n\n### How do I fix the issue?\n\n**Upgrade** to the version of `langgraph-checkpoint-mongodb` and `langgraph-store-mongodb`.\nIf you cannot upgrade immediately, apply the following mitigation: in your application code,\nbefore passing any user-controlled input to the `filter` parameter, remove or escape MongoDB\nQuery metacharacters such as “$”.\n\n---\n\n## Acknowledgements\nThanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security\nAdvisory program on the langchain-mongodb repository.\n\n---\n\n## Revisions\n\n| Date | Description |\n|---|---|\n| 2026-06-05 | Initial advisory published |",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "langgraph-checkpoint-mongodb"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.3.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "langgraph-store-mongodb"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.4.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/langchain-ai/langchain-mongodb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-943" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-20T17:29:14Z",
    "nvd_published_at" : null
  }
}