https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 14:55:42 +0000 https://cve.radiocsirt.org/vuln/cve-2026-106119 <p><strong>Affected:</strong> langchain-ai langchainjs, @langchain mongodb</p> <p>LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users&#39; histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user&#39;s stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.</p> <p><strong>Affected:</strong> langchain-ai langchainjs, @langchain mongodb</p> <p>LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users&#39; histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user&#39;s stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-106119