Three LangChain Integration Advisories Where User Input Hits the Backend

Between 24 September and 8 October 2026, LangChain published three security advisories for integration packages rather than for the core framework. @langchain/mongodb could let one user read another user's chat history. @langchain/redis didn't escape values in RediSearch filters. langchain-nvidia-ai-endpoints accepted local file paths as image inputs and sent the file contents to the model endpoint.

The common thread is input that the application treats as data reaching a backend that treats it as structure: a MongoDB query, a RediSearch expression or a filesystem path. All three are only reachable if your application passes user-controlled values into the affected parameter, which makes them a good exercise in checking reachability instead of just versions.

What's affected

• CVE-2026-106119, @langchain/mongodb (npm), medium. Published 8 October 2026. MongoDBChatMessageHistory didn't enforce at runtime that session identifiers are strings, so a structured session identifier could be interpreted as a MongoDB query condition. Affects 1.3.0 and earlier, fixed in 1.3.1 (published to npm on 27 September 2026).
• CVE-2026-105799, @langchain/redis (npm), low. Published 6 October 2026. Values used in structured RediSearch TAG and TEXT filters weren't escaped, so a caller could inject RediSearch syntax and broaden a query. Affects 1.1.0 and earlier, fixed in 1.1.1 (published to npm on 15 April 2026).
• GHSA-g28h-2cmm-rj9x, langchain-nvidia-ai-endpoints (PyPI), high, CVSS 7.5. Published 24 September 2026, no CVE assigned. ChatNVIDIA and NVIDIARerank accepted raw local filesystem paths as VLM image inputs, read the file and included it in the outbound request to the configured NVIDIA or NIM endpoint. Affects 1.4.1 and earlier, fixed in 1.4.2 (uploaded to PyPI on 23 June 2026).

As with many advisories this autumn, the fixes predate publication, in one case by almost six months.

How to check if you're exposed

Versions first:

npm ls @langchain/mongodb @langchain/redis 2>/dev/null
pip show langchain-nvidia-ai-endpoints 2>/dev/null | grep -i ^version

Then the part that decides real exposure. For each package, find where the risky parameter gets its value.

MongoDB chat history. The advisory says you're affected when untrusted session identifiers reach MongoDBChatMessageHistory and several users' histories share one collection:

grep -rn "MongoDBChatMessageHistory" --include=*.ts --include=*.js src/ | head

Look at the sessionId argument. If it comes from req.body, req.query or a client-sent header, it's reachable, because a JSON body can carry an object where you expected a string. If it's derived from the authenticated user on the server, the advisory says this path doesn't apply.

Redis vector store filters. Reachable if attacker-influenced values go into TAG or TEXT filters, and it matters most when that filter is your tenant or document access boundary:

grep -rnE "RedisVectorStore|filter" --include=*.ts src/ | grep -i redis

NVIDIA VLM images. Reachable if users can supply image URLs or document image metadata to ChatNVIDIA or NVIDIARerank:

grep -rnE "ChatNVIDIA|NVIDIARerank" --include=*.py . | head

If those calls only ever receive images your own code generated, you're not exposed. If a user can type or upload an image reference, a path like /app/.env would have been read on affected versions.

What to do now

1. Upgrade: @langchain/mongodb to 1.3.1 or later, @langchain/redis to 1.1.1 or later (1.1.3 is current), and langchain-nvidia-ai-endpoints to 1.4.2 or later (1.5.0 is current).
2. Derive chat session identifiers on the server from the authenticated user, and reject anything that isn't a non-empty string. That was the advisory's workaround and is good practice regardless.
3. Don't use a vector store filter as your only tenant boundary when the filter value can be influenced by the caller. Bind the tenant filter on the server.
4. For VLM inputs, accept only remote URLs, data:image/... URIs or known asset IDs, which is what the patched NVIDIA package now enforces.
5. Run AI services with least-privilege filesystem access so a path read finds nothing worth sending.

Why it matters

LangChain's core packages get most of the scrutiny, but the integration packages are where data meets real backends. Each one translates framework calls into a MongoDB query, a Redis search string or a file read, and each translation is a place where escaping or type checks can go missing. These are classic injection bugs, NoSQL operator injection and query syntax injection, showing up in AI plumbing.

Versions alone overstate the problem here. An app can carry all three vulnerable packages and still not be exploitable, because nothing user-controlled reaches the parameter. Equally, one route that passes req.body.sessionId straight through is enough. Checking the call sites is what tells the two apart.

Try it yourself

Pick one of the three packages you use and trace a single request from the HTTP handler to the vulnerable parameter. Note whether any user-controlled value reaches it. Then see how finding and fixing a vulnerable dependency looks end to end:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-m6rx-h84q-8r95: MongoDBChatMessageHistory query injection (CVE-2026-106119)
• GHSA-5x6v-p487-7qh2: RediSearch filter injection via unescaped TAG and TEXT values (CVE-2026-105799)
• GHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints local file disclosure through VLM image inputs
• @langchain/mongodb on npm
• @langchain/redis on npm
• langchain-nvidia-ai-endpoints on PyPI