In affected @langchain/mongodb integrations, the documented string session identifier was not checked at runtime. An application that passed untrusted JSON-shaped identifiers into MongoDBChatMessageHistory could cause the value to be treated as a query condition rather than a literal key. If multiple users shared a message collection and callers could…
Inspect the ClaimsCase · DiggingBeagle record
LangChain MongoDB chat history accepted query-shaped session IDs across user boundaries
GHSA-m6rx-h84q-8r95 describes query injection through untrusted structured MongoDBChatMessageHistory session IDs, with cross-user conversation exposure possible under shared-collection conditions.
Scope
@langchain/mongodb through 1.3.0, only where callers can control structured session IDs and multiple users store histories in the same collection; fixed in 1.3.1.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Maintainer-origin GHSA establishes a conditional cross-session query-injection defect and the 1.3.1 fixed release. The demonstrated technical precondition is a user-controlled structured session value in a shared MongoDB collection, not a confirmed customer compromise.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LC-QUERY-IDENTIFIER · CLM-LC-EXPOSURE-PREREQ · CLM-LC-PATCH · LangChain GHSA-m6rx-h84q-8r95: MongoDB chat history cross-session access
At a glance
Upgrading @langchain/mongodb to 1.3.1 fixes the disclosed adapter behavior. Independently binding chat-history lookups to a server-derived authenticated principal, a strict scalar session ID and tenant-specific authorization guards against applications passing attacker-shaped query objects; a package patch alone does not implement each application’s tenant…
Read the implicationsWhether the vulnerable class was exposed in widely deployed agent products. Confirmed application-level data exposure or victim prevalence. Whether similar memory adapters enforce session tenancy server-side.
Limits and uncertaintyFull account
In affected @langchain/mongodb integrations, the documented string session identifier was not checked at runtime. An application that passed untrusted JSON-shaped identifiers into MongoDBChatMessageHistory could cause the value to be treated as a query condition rather than a literal key. If multiple users shared a message collection and callers could access history operations, this could cross conversation boundaries and enable unauthorized reads, edits or deletions. The maintainer-origin advisory identifies version 1.3.1 as the fix. Deployments deriving an enforced string ID from the authenticated session are outside the described exploit path. The disclosure does not establish a verified production victim or prompt injection by the LLM itself.
Mechanism and trust boundary
- 01
User-controlled session ID
An application forwards an untrusted structured value as a supposed chat-session identifier.
Boundary: External request value to MongoDB query construction
- 02
Shared conversation collection
The structured value changes the query and may select another user’s chat history.
Boundary: One user chat-session identity to another user stored memory
Timeline
- Oct 5, 2026disclosure
Maintainer advisory and 1.3.1 fix
Advisory described structured session ID injection and identified the fixed @langchain/mongodb version.
Claims & evidence
CLM-LC-PATCHThe affected @langchain/mongodb versions are through 1.3.0 and the advisory names version 1.3.1 as patched.supported
Basis: reported finding
- supportsLangChain GHSA-m6rx-h84q-8r95: MongoDB chat history cross-session accessprimary disclosure
Affected versions; Patched versions; Patches
CLM-LC-EXPOSURE-PREREQCross-user reads, changes or deletion are possible only for applications passing untrusted identifiers to chat-history operations and storing users’ histories in a shared collection; server-controlled typed identifiers avoid this path.supported
Basis: reported finding
- supportsLangChain GHSA-m6rx-h84q-8r95: MongoDB chat history cross-session accessprimary disclosure
Impact section, affected application conditions
CLM-LC-QUERY-IDENTIFIERThe LangChain advisory states that MongoDBChatMessageHistory could treat an untrusted structured session identifier as a MongoDB query condition rather than a literal string.supported
Basis: reported finding
- supportsLangChain GHSA-m6rx-h84q-8r95: MongoDB chat history cross-session accessprimary disclosure
Impact section
Implications
Upgrading @langchain/mongodb to 1.3.1 fixes the disclosed adapter behavior. Independently binding chat-history lookups to a server-derived authenticated principal, a strict scalar session ID and tenant-specific authorization guards against applications passing attacker-shaped query objects; a package patch alone does not implement each application’s tenant separation policy.
Unknowns and contradictions
- Whether the vulnerable class was exposed in widely deployed agent products.
- Confirmed application-level data exposure or victim prevalence.
- Whether similar memory adapters enforce session tenancy server-side.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123