HIGH7.7PyPI
GHSA-f4xh-w4cj-qxq8· CVE-2026-59152LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Modified: 9/10/2026
package
PyPI/langsmith
pkg:pypi/langsmith
HIGH7.1PyPInpm
GHSA-3644-q5cj-c5c7· CVE-2026-45134, PYSEC-2026-2555LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Modified: 9/10/2026
HIGH7.1PyPI
PYSEC-2026-2582· CVE-2026-45134, GHSA-3644-q5cj-c5c7LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2583· CVE-2026-41182, GHSA-rr7j-v2q5-chgvLangSmith SDK: Streaming token events bypass output redaction
Modified: 7/13/2026
MEDIUM5.8PyPI
PYSEC-2026-2584· CVE-2026-25528, GHSA-v34v-rq6j-cj6pLangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Modified: 7/13/2026
MEDIUM5.3npmPyPI
GHSA-rr7j-v2q5-chgv· CVE-2026-41182, PYSEC-2026-2583LangSmith SDK: Streaming token events bypass output redaction
Modified: 9/10/2026
MEDIUM5.8PyPInpm
GHSA-v34v-rq6j-cj6p· CVE-2026-25528, PYSEC-2026-2584LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Modified: 9/10/2026