Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
HIGH severity

GHSA-533j-2v4q-mw5h — langgraph-checkpoint-mong…

HIGH

GHSA-533j-2v4q-mw5h is a high-severity (CVSS 7.7) CWE-943 vulnerability in langgraph-checkpoint-mongodb. A fix is available for langgraph-checkpoint-mongodb — see the affected versions and patch details below.

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Also known asCVE-2026-55253PYSEC-2026-3859PYSEC-2026-3860
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-533j-2v4q-mw5h.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs43th percentile — riskier than 43% of all scored CVEsHighest risk
0.03%0.36%0.70%1.03%0.5%0.5%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-533j-2v4q-mw5h by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 383,485 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
🐍langgraph-checkpoint-mongodb🐍langgraph-store-mongodb

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Executive Summary

A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.

CVSS Details

CVSS 4.0

FieldValue
CVSS Version4.0
Vector StringCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Base Score7.1 (High)
MetricValueRationale
Attack Vector (AV)NetworkTriggerable remotely via API
Attack Complexity (AC)LowNo special conditions required
Attack Requirements (AT)NoneNo prerequisite deployment or execution conditions
Privileges Required (PR)LowAuthenticated caller of the checkpoint/store API
User Interaction (UI)NoneNo user action required
Vulnerable System Confidentiality (VC)NoneNo direct impact on the vulnerable component itself
Vulnerable System Integrity (VI)NoneRead-only access
Vulnerable System Availability (VA)NoneNo service disruption
Subsequent System Confidentiality (SC)HighFull access to other tenants' checkpoint data
Subsequent System Integrity (SI)NoneNo write or modification capability
Subsequent System Availability (SA)NoneNo service disruption to downstream systems

CVSS 3.1

FieldValue
CVSS Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Base Score7.7 (High)
MetricValueRationale
Attack VectorNetworkTriggerable remotely via API
Attack ComplexityLowNo special conditions required
Privileges RequiredLowAuthenticated caller of the checkpoint/store API
User InteractionNoneNo user action required
ScopeChangedImpact crosses tenant boundaries
ConfidentialityHighFull access to other tenants' checkpoint data
IntegrityNoneRead-only access
AvailabilityNoneNo service disruption

Affected Packages

PackageDistributionAffected MethodsAffected Versions
langgraph-checkpoint-mongodbPyPIMongoDBSaver.list(), MongoDBSaver.alist()< 0.3.0
langgraph-store-mongodbPyPIMongoDBStore.search()< 0.4.0

Advisory FAQ

How do I know if I am affected?

You are likely affected if all of the following are true:

  1. Your application uses langgraph-checkpoint-mongodb or langgraph-store-mongodb.
  2. Your application calls MongoDBSaver.list(), MongoDBSaver.alist(), or MongoDBStore.search() with a filter argument.
  3. Any part of that filter argument is derived from user-controlled input — for example, HTTP query parameters, request body fields, or agent tool arguments.
  4. You operate in a multi-tenant context where the filter is used to enforce per-user or per-tenant data isolation.

If the filter argument is constructed entirely from trusted, server-side values, the practical risk is lower, but upgrading is still recommended.

How do I fix the issue?

Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb. If you cannot upgrade immediately, apply the following mitigation: in your application code, before passing any user-controlled input to the filter parameter, remove or escape MongoDB Query metacharacters such as “$”.

Acknowledgements

Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.

Revisions

DateDescription
2026-06-05Initial advisory published

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIlanggraph-checkpoint-mongodball versions0.3.0pip install --upgrade 'langgraph-checkpoint-mongodb==0.3.0'
🐍PyPIlanggraph-store-mongodball versions0.4.0pip install --upgrade 'langgraph-store-mongodb==0.4.0'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langgraph-checkpoint-mongodb, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update langgraph-checkpoint-mongodb to 0.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-533j-2v4q-mw5h is resolved across your whole dependency graph.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

# Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query. --- ## CVSS Details ### CVSS 4.0 | Field | Value | |---|---| | **CVSS Version** | 4.0 | | **Vector String** |
O3 Security · Impact-Aware SCA

Is GHSA-533j-2v4q-mw5h in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-533j-2v4q-mw5h: High 7.7 severity | O3 Security