CVE-2026-105799: LangChain filter injection

Q: Is CVE-2026-105799 actively exploited?

No confirmed active exploitation of CVE-2026-105799 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-105799?

1. Upgrade @langchain/redis to 1.1.1 or later in all services and lockfiles, including transitive dependencies. 2. Do not rely on client-supplied filter values as the only access boundary. Enforce tenant isolation server-side, for example with separate indexes or per-tenant key prefixes, and build the tenant filter from the authenticated session rather than from request input. 3. Validate and allowlist filter values, and reject RediSearch special characters such as |, @, (, ), -, ~, * and quotes where they are not expected. 4. Detection: review Redis and application logs for FT.SEARCH queries containing unexpected operators or wildcard patterns, and for unusually large result sets from low-privilege users. 5. Use SCA tooling to find every project that depends on @langchain/redis at or below 1.1.0.

Q: What systems are affected by CVE-2026-105799?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, multi-tenant LLM applications, agent frameworks.

Q: What is the CVSS score for CVE-2026-105799?

No CVSS score has been assigned yet.

CISO Take

The @langchain/redis npm package, before version 1.1.1, does not escape attacker-controlled values in structured RediSearch TAG and TEXT filters. An attacker can inject RediSearch syntax to broaden the generated query and retrieve indexed documents outside their intended scope. The risk is highest in multi-tenant RAG applications that use these filters as a tenant or document-access boundary. No CVSS score or severity has been published yet, and there is no public exploit, Nuclei template or KEV listing. The EPSS score is low (0.00278) but sits in the top 81% by percentile, and the package has 3,072 downstream dependents and 60 other CVEs on record. Upgrade to @langchain/redis 1.1.1 and audit any place where user input reaches Redis filters.

Sources:NVDGitHub AdvisoryEPSSATLASOpenSSF

What is the risk?

Moderate, pending an official CVSS score. Exploitation needs no special AI/ML skill, only the ability to influence a filter value, and the impact is confidentiality loss through cross-tenant or cross-scope document exposure. Risk depends on how the application is built. It is high where filters enforce access control on user-supplied input, and negligible where filters are server-controlled constants. No public exploit, scanner template or KEV listing exists. The EPSS score is low in absolute terms (0.00278) but in the top 81% by percentile. The package's OpenSSF Scorecard is middling (5.8/10), and it has 60 other CVEs on record, which suggests a recurring defect rate worth watching.

How does the attack unfold?

Initial Access

The attacker, an authenticated user of a multi-tenant RAG app, supplies a crafted value for a field that feeds a Redis TAG or TEXT filter.

AML.T0049

Query Injection

Unescaped RediSearch syntax alters or broadens the generated search query, defeating the intended tenant or document scope.

AML.T0085.000

Collection

The vector store returns documents outside the attacker's authorized scope, which the application passes to the LLM as context.

AML.T0036

Impact

The LLM response or retrieved results disclose confidential cross-tenant data to the attacker.

AML.T0085.000

Initial Access

The attacker, an authenticated user of a multi-tenant RAG app, supplies a crafted value for a field that feeds a Redis TAG or TEXT filter.

AML.T0049

Query Injection

Unescaped RediSearch syntax alters or broadens the generated search query, defeating the intended tenant or document scope.

AML.T0085.000

Collection

The vector store returns documents outside the attacker's authorized scope, which the application passes to the LLM as context.

AML.T0036

Impact

The LLM response or retrieved results disclose confidential cross-tenant data to the attacker.

AML.T0085.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	npm	<= 1.1.0	`1.1.1`
148.4KOpenSSF 6.13.1K dependentsPushed 7d ago30% patched~164d to patchFull package profile →

Do you use LangChain? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

5 steps

Upgrade @langchain/redis to 1.1.1 or later in all services and lockfiles, including transitive dependencies.
Do not rely on client-supplied filter values as the only access boundary. Enforce tenant isolation server-side, for example with separate indexes or per-tenant key prefixes, and build the tenant filter from the authenticated session rather than from request input.
Validate and allowlist filter values, and reject RediSearch special characters such as |, @, (, ), -, ~, * and quotes where they are not expected.
Detection: review Redis and application logs for FT.SEARCH queries containing unexpected operators or wildcard patterns, and for unusually large result sets from low-privilege users.
Use SCA tooling to find every project that depends on @langchain/redis at or below 1.1.0.

How is it classified?

Data LeakageData ExtractionRAGFrameworkAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0085.000- RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-105799?

The @langchain/redis npm package, before version 1.1.1, does not escape attacker-controlled values in structured RediSearch TAG and TEXT filters. An attacker can inject RediSearch syntax to broaden the generated query and retrieve indexed documents outside their intended scope. The risk is highest in multi-tenant RAG applications that use these filters as a tenant or document-access boundary. No CVSS score or severity has been published yet, and there is no public exploit, Nuclei template or KEV listing. The EPSS score is low (0.00278) but sits in the top 81% by percentile, and the package has 3,072 downstream dependents and 60 other CVEs on record. Upgrade to @langchain/redis 1.1.1 and audit any place where user input reaches Redis filters.

Is CVE-2026-105799 actively exploited?

No confirmed active exploitation of CVE-2026-105799 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-105799?

1. Upgrade @langchain/redis to 1.1.1 or later in all services and lockfiles, including transitive dependencies. 2. Do not rely on client-supplied filter values as the only access boundary. Enforce tenant isolation server-side, for example with separate indexes or per-tenant key prefixes, and build the tenant filter from the authenticated session rather than from request input. 3. Validate and allowlist filter values, and reject RediSearch special characters such as |, @, (, ), -, ~, * and quotes where they are not expected. 4. Detection: review Redis and application logs for FT.SEARCH queries containing unexpected operators or wildcard patterns, and for unusually large result sets from low-privilege users. 5. Use SCA tooling to find every project that depends on @langchain/redis at or below 1.1.0.

What systems are affected by CVE-2026-105799?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, multi-tenant LLM applications, agent frameworks.

What is the CVSS score for CVE-2026-105799?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesmulti-tenant LLM applicationsagent frameworks

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0085.000RAG Databases

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM08

What are the technical details?

Original Advisory

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1.

Exploitation Scenario

A SaaS vendor offers a multi-tenant RAG assistant on Redis, with documents indexed per tenant and a tenant TAG filter built from a user-influenced parameter. An authenticated low-privilege user sends a crafted filter value containing RediSearch syntax, such as an OR clause or wildcard, that turns the tenant constraint into a broader match. The query returns chunks belonging to other tenants, which the application feeds to the LLM as context. The attacker asks questions that make the model reveal the content, and so extracts confidential documents from other customers.

Weaknesses (CWE)

CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query Logic

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE corpus.