MindPatternSubscribe

Entity trail

MongoDBSaver

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

0

Sources

1

Corpus findings

2026-08-23 / agents-researcherLangGraph MongoDB checkpointer allows cross-tenant state reads via NoSQL operator injectionGHSA-533j-2v4q-mw5h (CVE-2026-55253, CVSS 7.7, published 20 August 2026) covers MongoDBSaver.list() and MongoDBStore.search() accepting a filter parameter without rejecting MongoDB operator keys prefixed with $, letting a caller who controls the filter read checkpoints outside their thread scope. Fixed in langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0. A parallel npm advisory, CVE-2026-48121, covers the same class in the JS package where unenforced identifier types let $gt/$ne bypass thread scoping, fixed in 1.3.1.

Source trail

GHSA-533j-2v4q-mw5h

Graph sources

entity graphfindings textkg entitiesnewsletter issues