CVE-2026-105799: LangChain Redis Filter Injection Vulnerability

CVE-2026-105799 Overview

CVE-2026-105799 affects @langchain/redis, a Redis integration for the LangChain JavaScript framework used to build large language model (LLM) applications. Versions prior to 1.1.1 fail to escape attacker-controlled values within structured RediSearch TAG and TEXT filters. An attacker who can influence filter inputs can inject RediSearch syntax that alters or broadens the generated search query. When the application uses filters as a tenant or document-access boundary, the modified query exposes indexed documents outside the attacker's intended scope. The maintainers released a fix in version 1.1.1.

Critical Impact
Cross-tenant data exposure in LangChain Redis vector stores when attacker-controlled values are passed into RediSearch filter expressions used as access boundaries.

Affected Products

@langchain/redis versions prior to 1.1.1
LangChain.js applications using Redis vector stores with filter-based access control
Multi-tenant retrieval-augmented generation (RAG) pipelines backed by RediSearch

Discovery Timeline

2026-10-06 - CVE-2026-105799 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105799

Vulnerability Analysis

The vulnerability is an injection flaw in the construction of RediSearch queries, classified as [CWE-943] Improper Neutralization of Special Elements in Data Query Logic. The @langchain/redis package builds structured RediSearch TAG (@field:{value}) and TEXT (@field:value) filter clauses by concatenating caller-supplied values directly into the query string. RediSearch treats several ASCII characters as syntactic separators, including {, }, |, :, (, ), and -. Supplying any of these characters inside a filter value lets the attacker close the current clause and append new predicates. In a RAG workflow, this permits a prompt or request parameter to broaden a @tenant:{acme} constraint into a disjunction such as @tenant:{acme|other}, returning indexed documents belonging to other tenants.

Root Cause

The root cause is the absence of input sanitization and field-name validation in the filter builder in libs/providers/langchain-redis/src/filters.ts. User-provided values were serialized into the RediSearch grammar without escaping reserved characters, and field names were not validated against an allow-list before being embedded in the query.

Attack Vector

Exploitation requires network access to an application that forwards an attacker-influenceable string into a @langchain/redis filter used as an access boundary. The attacker submits a crafted filter value containing RediSearch metacharacters. The resulting query matches documents outside the authorized scope, which the application then returns or feeds into the LLM context window.

typescript

// Security patch - libs/providers/langchain-redis/src/filters.ts
+import {
+  assertSafeRedisearchFieldName,
+  escapeRedisearchValue,
+} from "./query_safety.js";
+
 /**
  * Filter expression classes for advanced metadata filtering in Redis vector stores.
  */

typescript

// Security patch - libs/providers/langchain-redis/src/query_safety.ts
+const SAFE_FIELD_NAME_REGEX = /^[a-zA-Z0-9_.-]+$/;
+
+const REDISEARCH_SPECIAL_CHARS = new Set([
+  ",", ".", "<", ">", "{", "}", "[", "]",
+  '"', "'", ":", ";", "!", "@", "#", "$",
+  "%", "^", "&", "*", "(", ")", "-", "+",
+  "=", "~", "\\",
+]);

Source: GitHub commit 880e3969. The fix adds a strict field-name regex and an escape routine for RediSearch metacharacters before any value is embedded in a filter clause.

Detection Methods for CVE-2026-105799

Indicators of Compromise

RediSearch query strings in application logs containing unexpected |, }, or { characters inside tag filter values
RAG responses containing documents whose tenant or ACL metadata does not match the requesting user
Elevated hit counts on FT.SEARCH operations compared to baseline per-tenant request volume

Detection Strategies

Inventory applications using @langchain/redis and compare installed versions against 1.1.1 using npm ls @langchain/redis
Instrument the Redis vector store wrapper to log the final generated query string and alert on reserved characters in filter values
Review source code for callers that pass unsanitized user input, prompt output, or tool arguments into RedisVectorStore filter parameters

Monitoring Recommendations

Enable Redis SLOWLOG and command auditing for FT.SEARCH operations and correlate query shape with authenticated user identity
Monitor outbound LLM responses for data labeled with tenant identifiers that differ from the session principal
Track dependency manifests in CI pipelines to flag any downgrade of @langchain/redis below 1.1.1

How to Mitigate CVE-2026-105799

Immediate Actions Required

Upgrade @langchain/redis to version 1.1.1 or later across all services and rebuild deployment artifacts
Audit application code for every call site that constructs Redis filter expressions from untrusted input
Rotate or re-scope any tenant isolation keys if logs indicate successful cross-tenant retrieval

Patch Information

The fix is available in @langchain/redis release 1.1.1, delivered through GitHub pull request #10701. Technical details are documented in GitHub Security Advisory GHSA-5x6v-p487-7qh2. The patch introduces assertSafeRedisearchFieldName and escapeRedisearchValue helpers in a new query_safety.ts module and routes all filter construction through them.

Workarounds

Validate filter values against a strict allow-list such as ^[a-zA-Z0-9_.-]+$ before passing them to the vector store
Enforce tenant isolation at the Redis key or index level rather than relying solely on query-time filters
Reject or strip RediSearch metacharacters including {, }, |, :, (, ), and - from any user- or LLM-derived filter input

bash

# Upgrade @langchain/redis to the patched release
npm install @langchain/redis@^1.1.1
npm ls @langchain/redis