CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8), @sonic-agent-kit/agent-setup-lib (>=1.0.5, <=1.0.6) +1 more potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (>=0.0.2, <=1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version =0.0.2, =0.2.7, =1.0.5, =1.0.0, =1.0.27 Source cves: CVE-2026-48121 Source advisory: MEND:CVE-2026-48121...

CVE-2026-48121: Improper Neutralization of Special Elements in Data Query Logic

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

CVE-2026-14742 langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash

A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function freeze of the file libs/langgraph/langgraph/internal/cache.py of the component Task Result Cache. This manipulation of the argument defaultcachekey causes use of weak hash. The attack is...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8) potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.2.8 Source cves: CVE-2026-48121 Source advisory:...

CVE-2026-27022: Improper Neutralization of Special Elements in Output Used by a Downstream Component

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directl...