HIGH 7.7 GitHub
CVE-2026-55253
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
# Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and
langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods
accept a filter parameter that is incorporated into MongoDB queries without sufficient validation.
Because MongoDB query operator keys (those prefixed with $) are not rejected during filter
construction, a caller with control of the filter input can embed MongoDB query operators
directly into the query.
---
## CVSS
Affected Products
- pip/langgraph-checkpoint-mongodb < 0.3.0
- pip/langgraph-store-mongodb < 0.4.0
References
- https://github.com/advisories/GHSA-533j-2v4q-mw5h
- https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h
- https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint
- https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mong
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-08-20 via GitHub. Affected: pip/langgraph-checkpoint-mongodb < 0.3.0, pip/langgraph-store-mongodb < 0.4.0.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.