Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a NoSQL injection in the MongoDBSaver class of the @langchain/langgraph-checkpoint-mongodb package. The root cause is the lack of input validation on checkpoint identifier fields (thread_id, checkpoint_ns, checkpoint_id) that are sourced from the config.configurable object. These fields were used directly in MongoDB queries, allowing an attacker to inject MongoDB operators like $gt and $ne instead of simple string identifiers. This could bypass the intended multi-tenant data separation, allowing an attacker to read, and potentially write or delete, checkpoint data belonging to other users or tenants. The patch addresses this by introducing a getStringConfigValue function that enforces string-only values for these identifiers at runtime, causing any non-string input to be rejected before it reaches the database query.
MongoDBSaver.getTuplelibs/checkpoint-mongodb/src/checkpoint.ts
MongoDBSaver.listlibs/checkpoint-mongodb/src/checkpoint.ts
MongoDBSaver.putlibs/checkpoint-mongodb/src/checkpoint.ts
MongoDBSaver.putWriteslibs/checkpoint-mongodb/src/checkpoint.ts
MongoDBSaver.deleteThreadlibs/checkpoint-mongodb/src/checkpoint.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @langchain/langgraph-checkpoint-mongodb | npm | <= 1.3.0 | 1.3.1 |
This is a confidentiality issue with cross-tenant data disclosure risk.
An attacker-controlled request can inject MongoDB operators:
graph = new StateGraph(...)
.compile({
checkpointer: new MongoDBSaver()
});
graph.invoke(..., {
configurable: {
"thread_id": { "$gt": "" },
"checkpoint_ns": { "$ne": null }
}
});
If this payload is forwarded into config.configurable, the resulting query may match checkpoints outside the intended tenant/thread scope.
Version 1.3.1 hardens @langchain/langgraph-checkpoint-mongodb by adding runtime validation for configurable checkpoint identifiers and rejecting invalid values before MongoDB query/write paths execute.
The patch also includes regression tests covering object/operator payloads across affected methods.
Upgrade to @langchain/langgraph-checkpoint-mongodb@1.3.1 or later.
No API migration is required for valid callers. However, applications that currently pass non-string identifier values in config.configurable will now receive explicit errors and should normalize/validate inputs.
As defense in depth, validate identifier fields at API boundaries and avoid passing raw client objects into graph config.