{"id":"CVE-2026-106119","kind":"vulnerability","aliases":["CVE-2026-106119","GHSA-m6rx-h84q-8r95"],"related":[],"title":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access","description":"## Impact\r\n\r\n`MongoDBChatMessageHistory` did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.\r\n\r\nApplications are affected when they pass untrusted session identifier input to `MongoDBChatMessageHistory` and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation.\r\n\r\nApplications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path.\r\n\r\n## Patches\r\n\r\nThe issue is fixed in `@langchain/mongodb` version **1.3.1**.\r\n\r\nUsers of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries.\r\n\r\n## Workarounds\r\n\r\nIf an immediate upgrade is not possible, applications must reject session identifiers that are not non-empty strings. Session identifiers should be derived from an authenticated, server-controlled value and must not be passed directly from an untrusted request field.\r\n\r\nUpgrading remains the recommended remediation.","summary":"The MongoDB chat history class in the LangChain JavaScript package does not check that session identifiers are strings, so a structured session ID can be treated as a MongoDB query condition. An attacker who can trigger chat-history operations can read, change, or delete another user's stored conversation when users share one collection.","severity":"medium","cvss":6.0,"epss":0.00463,"exploited":false,"exploited_at":null,"products":[{"name":"@langchain/mongodb","fixed":["1.3.1"],"affected":"<= 1.3.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-agents","ai-tooling","cwe-943","langchain","mongodb","node"],"not_affected_if":["managed-hosting","server-derived-session-id","single-user-collection"],"how_to_check":"- Check the installed version of `@langchain/mongodb` in your lockfile or with `npm ls @langchain/mongodb`; versions `<= 1.3.0` are affected.\n- Search your code for `MongoDBChatMessageHistory` and confirm whether the `sessionId` value can come directly from an untrusted request field.\n- Check whether several users' histories share one MongoDB collection.","fix":"- `@langchain/mongodb` upgrade to `1.3.1` or later.\n- Until upgraded, reject session identifiers that are not non-empty strings, and derive them from an authenticated, server-controlled value.","status":"open","published_at":"2026-10-05T13:53:00+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","triaged_at":"2026-11-09T23:01:01+00:00","updated_at":"2026-11-09T23:01:01+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T23:01:01Z","model":"claude-haiku-5-5","output":{"fix":"- `@langchain/mongodb` upgrade to `1.3.1` or later.\n- Until upgraded, reject session identifiers that are not non-empty strings, and derive them from an authenticated, server-controlled value.","reach":"network","title":"LangChain: MongoDB chat history lets crafted session IDs read other users' chats","impact":"medium","summary":"The MongoDB chat history class in the LangChain JavaScript package does not check that session identifiers are strings, so a structured session ID can be treated as a MongoDB query condition. An attacker who can trigger chat-history operations can read, change, or delete another user's stored conversation when users share one collection.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["langchain","mongodb","node","ai-agents"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads, modifies or deletes other users' chat histories","analyst_note":"","how_to_check":"- Check the installed version of `@langchain/mongodb` in your lockfile or with `npm ls @langchain/mongodb`; versions `<= 1.3.0` are affected.\n- Search your code for `MongoDBChatMessageHistory` and confirm whether the `sessionId` value can come directly from an untrusted request field.\n- Check whether several users' histories share one MongoDB collection.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-user-collection","server-derived-session-id","managed-hosting"],"who_is_affected":"Applications that pass untrusted session identifier input into MongoDBChatMessageHistory and store multiple users' histories in the same collection are exposed. Applications that derive the session ID from an authenticated, server-controlled value and enforce its type are not affected by this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00084,"input_tokens":5036,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106119':13A,21A '-2026':12A,20A '-943':30B '1.3.1':198C,207C '8r95':18A 'abl':156C 'access':10A 'affect':104C,126C,186C,201C 'agent':25B 'ai':24B,27B 'ai-ag':23B 'ai-tool':26B 'allow':6A 'anoth':79B,162C 'applic':105C,124C,167C,237C 'attack':66B,146C 'authent':175C,256C 'chang':76B 'chat':36B,71B,151C 'chat-histori':70B,150C 'check':46B 'class':38B 'collect':88B,144C 'compar':222C 'condit':64B,117C 'control':178C,259C 'convers':83B,166C 'could':110C 'cross':8A 'cross-sess':7A 'cve':11A,19A 'cwe':29B 'delet':78B,161C 'deriv':169C,253C 'direct':266C 'document':95C 'empti':247C 'enforc':93C,181C 'ensur':219C 'field':271C 'fix':194C 'ghsa':15A 'ghsa-m6rx-h84q-8r95':14A 'h84q':17A 'histori':37B,72B,140C,152C 'id':56B 'identifi':49B,100C,109C,123C,132C,172C,215C,241C,250C 'immedi':232C 'impact':89C 'inject':4A 'input':133C 'interpret':112C 'invok':149C 'issu':192C 'javascript':42B 'langchain':1A,31B,41B 'langchain/mongodb':22A,196C 'later':209C 'liter':122C,224C 'm6rx':16A 'may':154C 'modifi':159C 'mongodb':32B,35B,62B,115C,227C 'mongodbchatmessagehistori':2A,90C,135C 'multipl':138C 'must':238C,262C 'node':33B 'non':246C 'non-empti':245C 'one':87B 'oper':73B,153C 'packag':43B 'pass':129C,265C 'patch':190C,211C 'path':189C 'possibl':236C 'queri':3A,63B,116C,228C 'rather':118C 'read':75B,158C 'recommend':275C 'reject':239C 'remain':273C 'remedi':276C 'request':270C 'runtim':102C,217C 'server':177C,258C 'server-control':176C,257C 'session':9A,48B,55B,99C,108C,131C,171C,214C,240C,249C 'share':86B 'store':82B,137C,165C 'string':51B,96C,248C 'structur':54B,107C 'tool':28B 'treat':59B 'trigger':69B 'type':97C,183C 'untrust':130C,269C 'upgrad':204C,233C,272C 'user':80B,85B,139C,163C,199C 'valid':213C 'valu':179C,225C,260C 'version':197C,202C,206C,212C 'workaround':229C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted session identifier input into MongoDBChatMessageHistory and store multiple users' histories in the same collection are exposed. Applications that derive the session ID from an authenticated, server-controlled value and enforce its type are not affected by this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongodb"],"ptokens":["langchain","mongodb"],"labels":["aiagents","aitooling","cwe943","langchain","medium","mongodb","node","npm"],"campaign_type":null,"search_a":"'-106119':13A,21A '-2026':12A,20A '8r95':18A 'access':10A 'allow':6A 'cross':8A 'cross-sess':7A 'cve':11A,19A 'ghsa':15A 'ghsa-m6rx-h84q-8r95':14A 'h84q':17A 'inject':4A 'langchain':1A 'langchain/mongodb':22A 'm6rx':16A 'mongodbchatmessagehistori':2A 'queri':3A 'session':9A","search_b":"'-943':30B 'agent':25B 'ai':24B,27B 'ai-ag':23B 'ai-tool':26B 'anoth':79B 'attack':66B 'chang':76B 'chat':36B,71B 'chat-histori':70B 'check':46B 'class':38B 'collect':88B 'condit':64B 'convers':83B 'cwe':29B 'delet':78B 'histori':37B,72B 'id':56B 'identifi':49B 'javascript':42B 'langchain':31B,41B 'mongodb':32B,35B,62B 'node':33B 'one':87B 'oper':73B 'packag':43B 'queri':63B 'read':75B 'session':48B,55B 'share':86B 'store':82B 'string':51B 'structur':54B 'tool':28B 'treat':59B 'trigger':69B 'user':80B,85B","search_c":"'1.3.1':198C,207C 'abl':156C 'affect':104C,126C,186C,201C 'anoth':162C 'applic':105C,124C,167C,237C 'attack':146C 'authent':175C,256C 'chat':151C 'chat-histori':150C 'collect':144C 'compar':222C 'condit':117C 'control':178C,259C 'convers':166C 'could':110C 'delet':161C 'deriv':169C,253C 'direct':266C 'document':95C 'empti':247C 'enforc':93C,181C 'ensur':219C 'field':271C 'fix':194C 'histori':140C,152C 'identifi':100C,109C,123C,132C,172C,215C,241C,250C 'immedi':232C 'impact':89C 'input':133C 'interpret':112C 'invok':149C 'issu':192C 'langchain/mongodb':196C 'later':209C 'liter':122C,224C 'may':154C 'modifi':159C 'mongodb':115C,227C 'mongodbchatmessagehistori':90C,135C 'multipl':138C 'must':238C,262C 'non':246C 'non-empti':245C 'oper':153C 'pass':129C,265C 'patch':190C,211C 'path':189C 'possibl':236C 'queri':116C,228C 'rather':118C 'read':158C 'recommend':275C 'reject':239C 'remain':273C 'remedi':276C 'request':270C 'runtim':102C,217C 'server':177C,258C 'server-control':176C,257C 'session':99C,108C,131C,171C,214C,240C,249C 'store':137C,165C 'string':96C,248C 'structur':107C 'type':97C,183C 'untrust':130C,269C 'upgrad':204C,233C,272C 'user':139C,163C,199C 'valid':213C 'valu':179C,225C,260C 'version':197C,202C,206C,212C 'workaround':229C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-05T13:53:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-m6rx-h84q-8r95","url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","severity":"medium","published_at":"2026-10-05T13:53:00+00:00","modified_at":"2026-10-06T18:00:12+00:00","first_seen_at":"2026-11-09T22:53:22+00:00","fetched_at":"2026-11-09T22:53:22+00:00","note":null},{"source":"ghsa","external_id":"GHSA-m6rx-h84q-8r95","url":"https://github.com/advisories/GHSA-m6rx-h84q-8r95","severity":"medium","published_at":"2026-10-08T17:52:22+00:00","modified_at":"2026-10-08T17:52:24+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-106119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119","severity":null,"published_at":"2026-10-06T19:17:42+00:00","modified_at":"2026-10-06T20:17:17+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110567,"url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-05T13:53:00+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110892,"url":"https://api.github.com/repos/langchain-ai/langchainjs/security-advisories/GHSA-m6rx-h84q-8r95","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110894,"url":"https://github.com/langchain-ai/langchainjs/pull/11672","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110895,"url":"https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110896,"url":"https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00463,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106119"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}