LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive SummaryA NoSQL injection issue exists in the langgraph-checkpoint-mongodb andlanggraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methodsaccept a filter parameter that is incorporated into MongoDB queries without sufficient validation.Because MongoDB query operat...