{"action":"Upgrade @langchain/mongodb to 1.3.1 or later.","affected":[{"fixed":"1.3.1","introduced":"0"}],"component":"@langchain/mongodb","cve_ids":["CVE-2026-106119"],"ecosystem":"npm","epss":0.00463,"exploited":false,"fixed_versions":["1.3.1"],"ghsa_id":"GHSA-m6rx-h84q-8r95","id":"tcs_01M5KFZWVH4RCVPH7CBM70PW1N","modified_at":"2026-10-08T18:00:08.902627724Z","published_at":"2026-10-08T17:52:22Z","references":["https://osv.dev/vulnerability/GHSA-m6rx-h84q-8r95","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","https://nvd.nist.gov/vuln/detail/CVE-2026-106119","https://github.com/langchain-ai/langchainjs/pull/11672","https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","https://github.com/langchain-ai/langchainjs","https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-m6rx-h84q-8r95","url":"https://osv.dev/vulnerability/GHSA-m6rx-h84q-8r95"},{"source":"nvd","source_id":"CVE-2026-106119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119"}],"summary":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access"}