NoSQL Operator Injection in LangGraph MongoDB Libraries

The LangGraph MongoDB integration libraries (langgraph-checkpoint-mongodb and langgraph-store-mongodb) are vulnerable to NoSQL operator injection (CVE-2026-55253). This vulnerability stems from inadequate sanitization of the 'filter' parameter passed to the 'MongoDBSaver.list()' and 'MongoDBStore.search()' methods. Because these methods allow caller-supplied input to be embedded directly into database queries, an authenticated attacker can inject MongoDB operator keys prefixed with '$'. In multi-tenant applications where these methods are relied upon for data isolation, an attacker can manipulate the query logic to access or exfiltrate checkpoint or store data belonging to other tenants. This flaw impacts all versions of langgraph-checkpoint-mongodb prior to 0.3.0 and langgraph-store-mongodb prior to 0.4.0. Defenders should audit application code to ensure that any 'filter' parameter passed to these libraries is strictly validated and stripped of characters associated with MongoDB query operators.

Impact

Successful exploitation of this vulnerability results in a loss of data confidentiality across tenant boundaries. Attackers can gain unauthorized read access to state, checkpoints, or stored data belonging to other users or organizations. Given the reliance on these libraries for agentic workflows and memory storage, the compromise allows for the mass exfiltration of sensitive conversational history or application state.

Recommendation

• Upgrade 'langgraph-checkpoint-mongodb' to version 0.3.0 or later and 'langgraph-store-mongodb' to version 0.4.0 or later to patch CVE-2026-55253.
• Audit application code to identify instances where user-controlled input (e.g., HTTP query parameters or request body fields) is passed directly to the 'filter' argument of 'MongoDBSaver.list()', 'MongoDBSaver.alist()', or 'MongoDBStore.search()'.
• Implement strict input validation or sanitization routines on the server side to remove or escape the '$' character from any user-provided data before it is incorporated into database filter objects.