{"action":"Upgrade langgraph-checkpoint-mongodb to 0.3.0 or later.","affected":[{"fixed":"0.3.0","introduced":"0"}],"component":"langgraph-checkpoint-mongodb","cve_ids":["CVE-2026-55253"],"ecosystem":"PyPI","epss":0.00531,"exploited":false,"fixed_versions":["0.3.0"],"ghsa_id":"GHSA-533j-2v4q-mw5h","id":"tcs_01M5KH878KFH3VA9B8SMNADE5M","modified_at":"2026-09-10T12:26:05.292311514Z","published_at":"2026-09-10T09:44:52.155128Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3859","https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h","https://github.com/langchain-ai/langchain-mongodb","https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0","https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0","https://pypi.org/project/langgraph-checkpoint-mongodb","https://github.com/advisories/GHSA-533j-2v4q-mw5h","https://nvd.nist.gov/vuln/detail/CVE-2026-55253"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-3859","url":"https://osv.dev/vulnerability/PYSEC-2026-3859"}],"summary":"LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure"}