LangChain is a framework for building LLM-powered applications.
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- MongoDB
- Product
- AI / LLM tooling, MongoDB
- Exposure class
- AI infrastructure, Database
Why it ranks 5 (Routine)
- Product class: AI infrastructure, database
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.