# CVE-2026-106119: LangChain MongoDBChatMessageHistory query operator injection

Source: https://junglewise.ai/threats/cve-2026-106119-langchain-is-a-framework-for-building-llm-powered-applications  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106119 · Severity: medium · CVSS 4 · Published 2026-10-06

LangChain is a framework for building AI applications that interact with large language models. The MongoDBChatMessageHistory component stores conversation history in MongoDB, but prior to version 1.3.1 it failed to validate that session identifiers are strings, allowing attackers to inject MongoDB query operators. An attacker who can control a session identifier could read, modify, or delete another user's stored conversations.

Vendors: [LangChain AI](https://junglewise.ai/threats/vendors/langchain-ai), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106119 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106119 being exploited in the wild.

**How severe is CVE-2026-106119?** Medium severity, with a CVSS score of 4, published 6 October 2026.

**Which products and versions are affected?** LangChain AI LangChain prior to 1.3.1; @langchain/mongodb (npm) <= 1.3.0, SEMVER:introduced=0,fixed=1.3.1.

**Is there a fix for CVE-2026-106119?** Yes. @langchain/mongodb (npm): upgrade to 1.3.1 or later. Until then: Ensure sessionId is always a server-validated string value and never sourced directly from untrusted request fields without validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106119 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106119?** Check whether you run LangChain AI LangChain or @langchain/mongodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @langchain/mongodb (npm): upgrade to 1.3.1 or later

  ```sh
  npm install @langchain/mongodb@1.3.1
  ```


Ensure sessionId is always a server-validated string value and never sourced directly from untrusted request fields without validation.

## Technical details

MongoDBChatMessageHistory placed the sessionId parameter directly into MongoDB filter queries without type validation, allowing an attacker to pass a query operator object (e.g. { $regex: "^alice" }) instead of a string literal and access other users' chat histories. The vulnerability requires the ability to invoke chat-history operations and affects applications using untrusted or unsanitized session identifiers. The fix validates sessionId as a non-empty string at construction time and wraps filters with $eq operators as defense-in-depth.

## Affected products

- LangChain AI LangChain prior to 1.3.1

## Identifiers

- CVE-2026-106119
- GHSA-m6rx-h84q-8r95

## Timeline

- 2026-10-06: disclosed
- 2026-09-22: patched

## References

- [https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af](https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af)
- [https://github.com/langchain-ai/langchainjs/pull/11672](https://github.com/langchain-ai/langchainjs/pull/11672)