Langchain

A NoSQL injection vulnerability in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries allows authenticated attackers to bypass tenant isolation boundaries and exfiltrate sensitive data via injected MongoDB query operators.

A path traversal vulnerability in LangChain Core's legacy `load_prompt` functions allows attackers to read arbitrary files by injecting malicious paths into prompt configurations.

LangChain is vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists, potentially leading to persistent chat-history poisoning, prompt injection, credential disclosure, or server-side requests.