langchain-ai Vulnerabilities and Affected Products
Vulnerabilities associated with langgraphjs.
Products
Clear product- langchain-ai/langchain12 vulnerabilities
- langchain9 vulnerabilities
- langgraph7 vulnerabilities
- langsmith-sdk5 vulnerabilities
- langchainjs4 vulnerabilities
- langchain-ai/langchainjs2 vulnerabilities
- langchain-ai\/langchain2 vulnerabilities
- langgraphjs2 vulnerabilities
- helm1 vulnerability
- langchain-ai1 vulnerability
- langchain-ai\/langchainjs1 vulnerability
- langchain-anthropic1 vulnerability
- langchain-openai1 vulnerability
- langchain-sdk1 vulnerability
- langchain-text-splitters1 vulnerability
- langgraph-checkpoint1 vulnerability
- langgraph-checkpoint-postgres1 vulnerability
- langgraph-checkpoint-sqlite1 vulnerability
- langraph-checkpoint1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-48121MEDIUM | @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an object payload (such as MongoDB operators $gt or $ne) instead of a string, it can be interpreted as a que… CWE-943Aug 4, 2026 | CVSS6.7v3.1 | EPSS0.229% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27022MEDIUM | RediSearch Query Injection in @langchain/langgraph-checkpoint-redis@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys and values without proper escaping. RediSearch has special syntax characters that can modify query behavior, and when user-controlled data contains these charact… CWE-74Feb 20, 2026 | CVSS6.5v3.1 | EPSS3.73% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |