CVE-2026-106119

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.3.1

Description In the MongoDBChatMessageHistory component, the system fails to enforce the required string type for untrusted structured session identifiers at runtime. This allows a session identifier to be interpreted as a MongoDB query condition instead of a literal value when multiple users share a MongoDB collection. An attacker capable of invoking chat-history operations can read, modify, or delete conversation histories belonging to other users. This issue does not affect applications that utilize authenticated, server-controlled string identifiers.

Recommendations Update to version 1.3.1.