CVE-2026-48121Published
@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-48121 · Microsoft / collected KEV context
cve-program · CVE-2026-48121
- https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx
- https://github.com/langchain-ai/langgraphjs/issues/2351
- https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c
euvd · EUVD-2026-52793
- https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx
- https://github.com/langchain-ai/langgraphjs/issues/2351
- https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c
nvd · CVE-2026-48121
- https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c
- https://github.com/langchain-ai/langgraphjs/issues/2351
- https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx
osv · GHSA-98xf-r82g-9mhx
- https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx
- https://github.com/langchain-ai/langgraphjs/issues/2351
- https://github.com/langchain-ai/langgraphjs/pull/2397
- https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c
- https://github.com/langchain-ai/langgraphjs
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.