Threats Tagged 'ghsa-m6rx-h84q-8r95'

CVE-2026-106119 is a vulnerability in langchainjs's MongoDBChatMessageHistory component where session identifiers are not properly validated at runtime. This allows specially crafted session identifiers to be interpreted as MongoDB query conditions instead of literal strings. An attacker able to invoke chat-history operations could potentially read, modify, or delete other users' conversation histories if multiple users' data share the same collection. The issue is fixed in @langchain/mongodb version 1.3.1 and later.