The vulnerability exists in the @langchain/langgraph-checkpoint-mongodb package's CheckpointSaver implementation, which uses MongoDB for storage. In versions 1.3.0 and earlier, checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed directly into MongoDB find() queries without enforcing that they are strings. An attacker supplying an object payload containing MongoDB operators like $gt or $ne can manipulate the query logic, bypassing thread scoping and leaking checkpoint data across tenants. This affects applications that accept untrusted input for these identifiers without coercion or schema validation. Applications that enforce string-only identifiers with schema validation are not vulnerable. The vulnerability is fixed in version 1.3.1.

Successful exploitation allows an attacker with limited privileges to bypass tenant isolation and access checkpoint data belonging to other tenants, including pending writes. This can lead to unauthorized disclosure of sensitive data. The vulnerability does not impact availability but has high confidentiality and integrity impact. It requires attacker control over input to config.configurable and some privileges to trigger the injection.

Upgrade to langgraphjs version 1.3.1 or later, where this issue is fixed. Until then, ensure that all checkpoint identifier inputs are strictly validated and coerced to strings before being passed to MongoDB queries. Reject or sanitize any non-string input to prevent injection of MongoDB operators. Applications that only use server-issued, string-typed identifiers with schema validation rejecting non-string fields are not affected and require no further action.