Skip to content
OpenAdvisories

Package · PyPI

langsmith

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-59152

    Arbitrary server-side file read in LangSmith SDK TracingMiddleware

    LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local…

    langchain-ai langsmith-sdk langsmith PyPI
  • Medium 5.3
    CVE-2026-41182

    LangSmith SDK: Streaming token events bypass output redaction

    LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do n…

    langchain-ai langsmith-sdk open-webui langfuse-3-worker Wolfi npm PyPI
  • Medium 5.8
    CVE-2026-25528

    LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

    LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through t…

    langchain-ai langsmith-sdk langfuse-3-worker langsmith Wolfi npm PyPI