django-ai-support (0.1.11), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (>=0.2.1, <=0.3.1)

langgraph-checkpoint-mongodb PYPI version =0.2.1, =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: MEND:CVE-2026-55253...

EUVD-2026-77674

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (0.2.1)

langgraph-checkpoint-mongodb PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-mongodb and may be impacted: - mseep-deer-flow =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: OSV:PYSEC-2026-3859...

GHSA-533J-2V4Q-MW5H LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...

mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (0.2.1)

langgraph-checkpoint-mongodb PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-mongodb and may be impacted: - mseep-deer-flow =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: OSV:GHSA-533J-2V4Q-MW5H...

mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (0.2.1)

langgraph-checkpoint-mongodb PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-mongodb and may be impacted: - mseep-deer-flow =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: GHSA-533J-2V4Q-MW5H...

PT-2026-80222

Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...

PT-2026-80768

Name of the Vulnerable Software and Affected Versions langgraph-checkpoint-mongodb versions prior to 0.3.0 langgraph-store-mongodb versions prior to 0.4.0 Description A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. The functions...

CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8), @sonic-agent-kit/agent-setup-lib (>=1.0.5, <=1.0.6) +1 more potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (>=0.0.2, <=1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version =0.0.2, =0.2.7, =1.0.5, =1.0.0, =1.0.27 Source cves: CVE-2026-48121 Source advisory: MEND:CVE-2026-48121...

CVE-2026-48121: Improper Neutralization of Special Elements in Data Query Logic

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8) potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.2.8 Source cves: CVE-2026-48121 Source advisory:...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8) potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.2.8 Source cves: CVE-2026-48121 Source advisory:...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8), @sonic-agent-kit/agent-setup-lib (>=1.0.5, <=1.0.6) +1 more potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-mongodb (>=0.0.2, <=1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version =0.0.2, =0.2.7, =1.0.5, =1.0.0, =1.0.27 Source cves: CVE-2026-27022 Source advisory: MEND:CVE-2026-27022...

@flutchai/flutch-sdk (>=0.2.7, <=0.2.8) potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.2.8 Source cves: CVE-2026-27022 Source advisory:...