GHSA-v34v-rq6j-cj6p
Medium · 5.8CVSS
5.8
EPSS
—
Published
Feb 9, 2026
CISA due date
—
The record
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | langsmith | 0.4.10 | 0.6.3 |
| npm | langsmith | 0.3.41 | 0.4.6 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r10 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r10 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r10 |
| Chainguard | kibana-9.2 | 0 | 9.2.5-r4 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.5-r4 |
| Chainguard | kibana-9.3 | 0 | 9.3.0-r2 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.0-r2 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r11 |
| Chainguard | langfuse-3-worker | 0 | 3.153.0-r2 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r12 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.153.0-r1 |
| Chainguard | librechat | 0 | 0.8.3-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.153.0-r2 |
Related vulnerabilities
- CVE-2026-25528 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Same vulnerability
- CVE-2026-45134 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-3644-q5cj-c5c7 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary… Also affects langsmith
- CVE-2026-41182 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-rr7j-v2q5-chgv LangSmith SDK: Streaming token events bypass output redaction Also affects langsmith
- GHSA-fw9q-39r9-c252 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__`… Also affects langsmith
- CVE-2026-40190 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-8.17