CVE-2026-105799: LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
@langchain/redis did not properly escape values used to construct structured RediSearch TAG and TEXT filters. An application that passes attacker-controlled values into these filters could allow the attacker to alter the resulting search query.
References
- github.com/advisories/GHSA-5x6v-p487-7qh2
- github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7
- github.com/langchain-ai/langchainjs/pull/10701
- github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1
- github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2
- nvd.nist.gov/vuln/detail/CVE-2026-105799
Code Behaviors & Features
Detect and mitigate CVE-2026-105799 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →