https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:36:00 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-106119 <p>LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users&#39; histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user&#39;s stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.</p> <p>LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users&#39; histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user&#39;s stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-106119