fix(mongodb): reject dict filter values to prevent NoSQL operator injection (#5748)

mem0/vector_stores/mongodb.py

@@ -148,6 +148,22 @@ class MongoDB(VectorStoreBase):
         except PyMongoError as e:
             logger.error(f"Error inserting data: {e}")
 
+    @staticmethod
+    def _validate_filter_value(key: str, value: Any) -> None:
+        """Reject values that could inject MongoDB query operators (e.g. $ne, $gt)."""
+        if isinstance(value, dict):
+            raise ValueError(
+                f"Filter value for {key!r} must be a scalar (str, int, float, bool), "
+                f"not a dict. Dicts may contain MongoDB query operators."
+            )
+        if isinstance(value, list):
+            for item in value:
+                if isinstance(item, dict):
+                    raise ValueError(
+                        f"Filter list for {key!r} contains a dict, "
+                        f"which may contain MongoDB query operators."
+                    )
+
     def search(self, query: str, vectors: List[float], top_k=5, filters: Optional[Dict] = None) -> List[OutputData]:
         """
         Search for similar vectors using the vector search index.
@@ -167,6 +183,10 @@ class MongoDB(VectorStoreBase):
             logger.error(f"Index '{self.index_name}' does not exist.")
             return []
 
+        if filters:
+            for key, value in filters.items():
+                self._validate_filter_value(key, value)
+
         results = []
         try:
             collection = self.client[self.db_name][self.collection_name]
@@ -215,6 +235,9 @@ class MongoDB(VectorStoreBase):
         Returns:
             List[OutputData]: Search results, or None if Atlas Search index is not available.
         """
+        if filters:
+            for key, value in filters.items():
+                self._validate_filter_value(key, value)
         try:
             collection = self.client[self.db_name][self.collection_name]
             search_index_name = f"{self.collection_name}_text_search_index"
@@ -369,6 +392,9 @@ class MongoDB(VectorStoreBase):
         Returns:
             List[OutputData]: List of vectors.
         """
+        if filters:
+            for key, value in filters.items():
+                self._validate_filter_value(key, value)
         try:
             query = {}
             if filters: