Evidence · DiggingBeagle record
LangChain GHSA-m6rx-h84q-8r95: MongoDB chat history cross-session access
Maintainer-origin advisory identifies structured session-ID query injection against shared MongoDB histories and records the fixed @langchain/mongodb 1.3.1.
- Published
- Oct 5, 2026
- Publisher
- LangChain / GitHub Security Advisory
- Source role
- primary disclosure
Evidence record
Maintainer-origin advisory identifies structured session-ID query injection against shared MongoDB histories and records the fixed @langchain/mongodb 1.3.1.
Claim-level citations (3)
- supportsLangChain MongoDB chat history accepted query-shaped session IDs across user boundaries: The affected @langchain/mongodb versions are through 1.3.0 and the advisory names version 1.3.1 as patched.
Affected versions; Patched versions; Patches
- supportsLangChain MongoDB chat history accepted query-shaped session IDs across user boundaries: Cross-user reads, changes or deletion are possible only for applications passing untrusted identifiers to chat-history operations and storing users’ histories in a shared collection; server-controlled typed identifiers avoid this path.
Impact section, affected application conditions
- supportsLangChain MongoDB chat history accepted query-shaped session IDs across user boundaries: The LangChain advisory states that MongoDBChatMessageHistory could treat an untrusted structured session identifier as a MongoDB query condition rather than a literal string.
Impact section