The vulnerability arises from improper neutralization of special elements in data query logic (CWE-943) within langchain-mongodb. Functions MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() accept filter dictionaries that are incorporated into MongoDB queries without recursively rejecting keys starting with '$'. An authenticated attacker controlling these filters via HTTP parameters or agent tool arguments can inject MongoDB Query Language operators such as $regex or $where. In multi-tenant environments relying on these filters for tenant isolation, this can lead to bypassing equality filters and unauthorized data exposure. The vulnerability is addressed in langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0.

An authenticated user can exploit this vulnerability to inject MongoDB query operators, bypassing intended per-user or per-tenant filtering controls. This can lead to unauthorized access to checkpoint or store data belonging to other tenants in a multi-tenant deployment. There is no indication of impact on data integrity or availability. Filters constructed solely from trusted server-side values are less at risk.

Upgrade to langgraph-checkpoint-mongodb version 0.3.0 or later and langgraph-store-mongodb version 0.4.0 or later, where this issue is fixed. Until upgraded, avoid using user-controlled filter dictionaries in MongoDB queries or ensure that keys prefixed with '$' are properly sanitized or rejected. No other mitigation or temporary fix is indicated.