LangChain's @langchain/redis component lets attackers inject RediSearch syntax when it receives unescaped tag or text values. The injected syntax can modify the search query and broaden or alter its results. The primary impact is that documents or data that should be protected by tenant or document‑access boundaries can be exposed to unauthorized users, leading to information disclosure.

The vulnerability affects the @langchain/redis package and the langchain‑ai:langchainjs project in versions prior to 1.1.1. Applications using these libraries without escaping filter inputs are at risk.

The CVSS score of 2.3 indicates low severity, and the EPSS score is not available, suggesting limited public exploit data. The issue is not listed in the CISA KEV catalog. However, the likely attack vector is an external user able to control tag or text filter values that are passed directly to RediSearch; when a user can influence these values—such as through a tenant boundary—the attacker can craft inputs that broaden the query scope and expose protected documents. This makes the vulnerability relevant for any application where filter values originate from an external source.