PyPI/langgraph-checkpoint-mongodb CVE-2026-55253: high 7.7, EPSS 0.53%

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Action: Upgrade langgraph-checkpoint-mongodb to 0.3.0 or later.

pip install langgraph-checkpoint-mongodb==0.3.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3859
• https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h
• https://github.com/langchain-ai/langchain-mongodb
• https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0
• https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0
• https://pypi.org/project/langgraph-checkpoint-mongodb
• https://github.com/advisories/GHSA-533j-2v4q-mw5h
• https://nvd.nist.gov/vuln/detail/CVE-2026-55253

CVE-2026-55253 · published 2026-09-10T09:44:52.155128Z · modified 2026-09-10T12:26:05.292311514Z · JSON