생태계	패키지	수정 버전
PyPI	langgraph-checkpoint-mongodb	0.3.0
PyPI	langgraph-store-mongodb	0.4.0

생태계

패키지

수정 버전

PyPI

langgraph-checkpoint-mongodb

0.3.0

PyPI

langgraph-store-mongodb

0.4.0

원문

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive Summary

A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.

CVSS Details

CVSS 4.0

Field	Value
CVSS Version	4.0
Vector String	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N`
Base Score	7.1 (High)

Metric	Value	Rationale
Attack Vector (AV)	Network	Triggerable remotely via API
Attack Complexity (AC)	Low	No special conditions required
Attack Requirements (AT)	None	No prerequisite deployment or execution conditions
Privileges Required (PR)	Low	Authenticated caller of the checkpoint/store API
User Interaction (UI)	None	No user action required
Vulnerable System Confidentiality (VC)	None	No direct impact on the vulnerable component itself
Vulnerable System Integrity (VI)

생태계	패키지	수정 버전
PyPI	langgraph-checkpoint-mongodb	0.3.0
PyPI	langgraph-store-mongodb	0.4.0

생태계

패키지

수정 버전

PyPI

langgraph-checkpoint-mongodb

0.3.0

PyPI

langgraph-store-mongodb

0.4.0

원문

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive Summary

CVSS Details

CVSS 4.0

Field	Value
CVSS Version	4.0
Vector String	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N`
Base Score	7.1 (High)

Metric	Value	Rationale
Attack Vector (AV)	Network	Triggerable remotely via API
Attack Complexity (AC)	Low	No special conditions required
Attack Requirements (AT)	None	No prerequisite deployment or execution conditions
Privileges Required (PR)	Low	Authenticated caller of the checkpoint/store API
User Interaction (UI)	None	No user action required
Vulnerable System Confidentiality (VC)	None	No direct impact on the vulnerable component itself
Vulnerable System Integrity (VI)

Package	Distribution	Affected Methods	Affected Versions
`langgraph-checkpoint-mongodb`	PyPI	`MongoDBSaver.list()`, `MongoDBSaver.alist()`	< 0.3.0
`langgraph-store-mongodb`	PyPI	`MongoDBStore.search()`	< 0.4.0

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

영향 받는 패키지

원문

Executive Summary

CVSS Details

CVSS 4.0

출처

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

영향 받는 패키지

원문

Executive Summary

CVSS Details

CVSS 4.0

출처

CVSS 3.1

Affected Packages

Advisory FAQ

How do I know if I am affected?

How do I fix the issue?

Acknowledgements

Revisions

Field	Value
CVSS Version	3.1
Vector String	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`
Base Score	7.7 (High)

Metric	Value	Rationale
Attack Vector	Network	Triggerable remotely via API
Attack Complexity	Low	No special conditions required
Privileges Required	Low	Authenticated caller of the checkpoint/store API
User Interaction	None	No user action required
Scope	Changed	Impact crosses tenant boundaries
Confidentiality	High	Full access to other tenants' checkpoint data
Integrity	None	Read-only access
Availability	None	No service disruption