https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 03:57:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-383616 EUVD-2026-383616 https://cve.radiocsirt.org/vuln/euvd-2026-383616 https://cve.radiocsirt.org/vuln/fkie_cve-2026-106119 <p>LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users&#39; histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user&#39;s stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.</p> <p>LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users&#39; histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user&#39;s stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-106119 https://cve.radiocsirt.org/vuln/ghsa-m6rx-h84q-8r95 <p><strong>Affected:</strong> npm: @langchain/mongodb</p> <p>## Impact</p> <p>`MongoDBChatMessageHistory` did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.</p> <p>Applications are affected when they pass untrusted session identifier input to `MongoDBChatMessageHistory` and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation.</p> <p>Applications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path.</p> <p>## Patches</p> <p>The issue is fixed in `@langchain/mongodb` version **1.3.1**.</p> <p>Users of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries.</p> <p>## Workarounds</p> <p>If an immediate upgrade is not possible, applications must reject session identifiers that are not non-empty strings. Session identifiers should be derived from an authenticated, server-controlled value and must not be passed directly from an untrusted request field.</p> <p>Upgrading remains the recommended remediation.</p> <p><strong>Affected:</strong> npm: @langchain/mongodb</p> <p>## Impact</p> <p>`MongoDBChatMessageHistory` did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.</p> <p>Applications are affected when they pass untrusted session identifier input to `MongoDBChatMessageHistory` and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation.</p> <p>Applications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path.</p> <p>## Patches</p> <p>The issue is fixed in `@langchain/mongodb` version **1.3.1**.</p> <p>Users of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries.</p> <p>## Workarounds</p> <p>If an immediate upgrade is not possible, applications must reject session identifiers that are not non-empty strings. Session identifiers should be derived from an authenticated, server-controlled value and must not be passed directly from an untrusted request field.</p> <p>Upgrading remains the recommended remediation.</p> https://cve.radiocsirt.org/vuln/ghsa-m6rx-h84q-8r95