Tools AI Risk Radar ai-incident-0188
Incident record
LangChain MongoDB fixes access to other users’ chat histories
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- @langchain/mongodb through 1.3.0
- Actor
- researcher
- CVE
- CVE-2026-106119
What happened
An application accepting an attacker-controlled session value could pass a MongoDB query condition into its chat-history store. This could expose or alter other users’ conversations.
Version 1.3.1 fixes the issue. Exploitation requires an application to accept untrusted non-string session input. The maintainer’s Moderate advisory was published on 5 October; the global CVE entry followed on 8 October.
Sources
- Primary disclosuregithub.com/langchain-ai/langchainjs/security/advisories/GHSA…
- Supporting primary sourcegithub.com/advisories/GHSA-m6rx-h84q-8r95
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026