GHSA-m6rx-h84q-8r95

Suggest an improvement
Source
https://github.com/advisories/GHSA-m6rx-h84q-8r95
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-m6rx-h84q-8r95/GHSA-m6rx-h84q-8r95.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m6rx-h84q-8r95
Aliases
Published
2026-10-08T17:52:22Z
Modified
2026-10-08T18:00:08Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
Details

Impact

MongoDBChatMessageHistory did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.

Applications are affected when they pass untrusted session identifier input to MongoDBChatMessageHistory and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation.

Applications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path.

Patches

The issue is fixed in @langchain/mongodb version 1.3.1.

Users of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries.

Workarounds

If an immediate upgrade is not possible, applications must reject session identifiers that are not non-empty strings. Session identifiers should be derived from an authenticated, server-controlled value and must not be passed directly from an untrusted request field.

Upgrading remains the recommended remediation.

Database specific 
{
    "cwe_ids": [
        "CWE-943"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:52:22Z",
    "nvd_published_at": "2026-10-06T19:17:42Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / @langchain/mongodb

Package

Name
@langchain/mongodb
View open source insights on deps.dev
Purl
pkg:npm/%40langchain/mongodb

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.1

Database specific

last_known_affected_version_range 
"<= 1.3.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-m6rx-h84q-8r95/GHSA-m6rx-h84q-8r95.json"