CVE-2026-55253

# Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query. --- ## CVSS Details ### CVSS 4.0 | Field | Value | |---|---| | **CVSS Version** | 4.0 | | **Vector String** | `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N` | | **Base Score** | **7.1 (High)** | | Metric | Value | Rationale | |---|---|---| | Attack Vector (AV) | Network | Triggerable remotely via API | | Attack Complexity (AC) | Low | No special conditions required | | Attack Requirements (AT) | None | No prerequisite deployment or execution conditions | | Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API | | User Interaction (UI) | None | No user action required | | Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself | | Vulnerable System Integrity (VI) | None | Read-only access | | Vulnerable System Availability (VA) | None | No service disruption | | Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data | | Subsequent System Integrity (SI) | None | No write or modification capability | | Subsequent System Availability (SA) | None | No service disruption to downstream systems | ### CVSS 3.1 | Field | Value | |---|---| | **CVSS Version** | 3.1 | | **Vector String** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N` | | **Base Score** | **7.7 (High)** | | Metric | Value | Rationale | |---|---|---| | Attack Vector | Network | Triggerable remotely via API | | Attack Complexity | Low | No special conditions required | | Privileges Required | Low | Au