CVE-2026-48121

@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

Published Aug 4, 2026 CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Description

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an object payload (such as MongoDB operators $gt or $ne) instead of a string, it can be interpreted as a query operator, bypassing thread scoping and leaking checkpoints, including pending writes, across tenants. Applications are at risk if they forward untrusted input into config.configurable without coercing it to strings or validating it against a schema, particularly in multi-tenant or user-isolated setups. Apps that only use server-issued, string-typed identifiers with schema validation rejecting non-string fields are not affected. This issue has been fixed in version 1.3.1.

Analysis

Technical impact

LangChain’s MongoDB checkpoint saver accepts untrusted configuration values for thread and checkpoint identifiers without type enforcement. If an attacker supplies an object that contains MongoDB query operators such as $gt or $ne, the query is interpreted as a NoSQL operator, bypassing the intended tenant isolation and allowing enumeration and retrieval of checkpoints from other users. The impact is data theft and leakage of pending writes across tenants, compromising confidentiality and potentially data integrity.

Affected Systems

The vulnerability affects the @langchain/langgraph-checkpoint-mongodb component of the langgraphjs library from langchain-ai. Versions 1.3.0 and older are susceptible; community and production deployments using those releases are impacted.

Risk and Exploitability

The CVSS score of 6.7 indicates moderate severity. EPSS is unavailable, so exploitation likelihood is unknown, and the issue is not listed in CISA KeV. Attackers can exploit the flaw by supplying crafted configuration values in a multi‑tenant or user‑isolated environment, where input is forwarded without coercion to string or validation. If an application uses only server‑issued, validated string identifiers, it remains safe.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

langchain-ai

langgraphjs

affected

Version	Status	Constraints
`< 1.3.1`	affected	—

No data.

Vendor Product Versions

Langchain-ai

Langgraphjs

Version	Status	Scheme	Platform
`[0,1.3.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to langgraphjs version 1.3.1 or newer where the injection issue is resolved
If an upgrade is not immediately possible, validate all checkpoint identifiers at runtime and coerce them to plain strings before passing them to MongoDBSaver.getTuple()
Enforce a JSON schema or equivalent validation that rejects any non‑string fields in the configuration to prevent injection objects from reaching the database

Generated by OpenCVE AI on August 4, 2026 at 19:26 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-98xf-r82g-9mhx	LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.313% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c
https://github.com/langchain-ai/langgraphjs/issues/2351
https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx

History

Aug 4, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 4, 2026 7:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Langchain-ai Langchain-ai langgraphjs
Vendors & Products		Langchain-ai Langchain-ai langgraphjs

Aug 4, 2026 5:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an object payload (such as MongoDB operators $gt or $ne) instead of a string, it can be interpreted as a query operator, bypassing thread scoping and leaking checkpoints, including pending writes, across tenants. Applications are at risk if they forward untrusted input into config.configurable without coercing it to strings or validating it against a schema, particularly in multi-tenant or user-isolated setups. Apps that only use server-issued, string-typed identifiers with schema validation rejecting non-string fields are not affected. This issue has been fixed in version 1.3.1.
Title		@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
Weaknesses		CWE-943
References		https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c https://github.com/langchain-ai/langgraphjs/issues/2351 https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'}`