Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M
CVE-2026-59152Arbitrary server-side file read in LangSmith SDK TracingMiddleware
Medium 5.0
In plain English
A medium-severity path traversal in langsmith-sdk from langchain-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary. This vulnerability is fixed in 0.8.18.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | langsmith | 0.8.18 | GHSA-f4xh-w4cj-qxq8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| langchain-ai | langsmith-sdk | < 0.8.18 |
Weakness: CWE-22, CWE-346, CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N