CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8), @sonic-agent-kit/agent-setup-lib (>=1.0.5, <=1.0.6) +1 more potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (>=0.0.2, <=1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version =0.0.2, =0.2.7, =1.0.5, =1.0.0, =1.0.27 Source cves: CVE-2026-48121 Source advisory: MEND:CVE-2026-48121...

CVE-2026-48121: Improper Neutralization of Special Elements in Data Query Logic

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8) potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.2.8 Source cves: CVE-2026-48121 Source advisory:...