§ langchain · storyline

Fixes MongoDB sessionId vulnerability, now rejects empty strings

LangChain patches MongoDB sessionId vulnerability in MongoDBChatMessageHistory, rejecting empty strings.

Sep 27 · 08:12:09 · primary fetch1 sourceupdated Sep 27 · 08:12:09

Patch Changes #11672 `946e3d8` Thanks @thushanth-bengre-langchain! - fix(mongodb): reject non-string sessionId in MongoDBChatMessageHistory and wrap query filters with $eq (GHSA-m6rx-h84q-8r95) Breaking: `sessionId: ""` now throws instead of silently working.

read full article on github.com ↗

§ sources1 publication · timeline below

github.comLangChain (JS) — mongodb v1.3.1primary08:12:09