@langchain/redis EUVD-2026-93431

Exploitation requires an application built on @langchain/redis prior to 1.1.1 that (1) passes attacker-controlled values into a structured RediSearch TAG or TEXT filter via the vulnerable buildCustomQuery tag/text paths, AND (2) relies on that filter as a tenant- or document-access boundary. The attacker must have low-privileged ability to influence the filter input (PR:L), and the injected value must contain RediSearch special characters that the pre-patch builder failed to escape. LIMITING FACTORS: this is a non-default, application-design-dependent condition (CVSS AT:P) - applications that do not use these filters as security boundaries, that use non-attacker-controlled filter values, or that have upgraded to 1.1.1 are not exploitable; impact is confined to read/exposure of indexed documents (no write, code execution, or availability effect).

All quantitative signals point to a LOW, highly conditional risk. The vendor CVSS 4.0 score is 2.3 (Low): AV:N and AC:L are offset by AT:P (a specific attack requirement - the application must use an attacker-influenceable filter as a trust boundary), PR:L (authenticated/low-privilege influence over filter input), and impact limited to VC:L with VI:N/VA:N (information disclosure only, no integrity or availability loss). No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code was identified, so exploitation is neither confirmed nor demonstrably probable. No SSVC decision data (exploitation/automatable/technical-impact) was supplied, so that framework cannot be applied. This is not a widespread-emergency priority: it is a conditional information-disclosure flaw whose real severity is entirely driven by application design. However, for the specific population that uses @langchain/redis RediSearch TAG/TEXT filters as a multi-tenant or document-access boundary, the practical consequence (cross-tenant data exposure) can be materially worse than the 2.3 score suggests - the low score reflects that this configuration is a prerequisite, not the ceiling of damage. Key missing data to note explicitly: no EPSS, no SSVC, and no KEV/POC signal to corroborate or contradict the low base score.

In a multi-tenant RAG application built on @langchain/redis (pre-1.1.1) that enforces tenant isolation through a RediSearch TAG or TEXT filter, a low-privileged user submits input containing unescaped RediSearch special characters (such as '|', '{', '}', or whitespace). Because the pre-1.1.1 filter builder does not escape attacker-controlled values, the injected syntax broadens the generated query and returns indexed documents belonging to other tenants or outside the intended access scope. No public exploit code was identified; exploitation is network-reachable (AV:N) but requires the specific filter-as-boundary configuration (AT:P) and low-privilege input influence (PR:L).