TI-2026-20637 Aliases CVE-2026-25528 GHSA-v34v-rq6j-cj6p

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

LOW 32CWE-918Published 2026-02-09 · Updated 2026-02-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00315 24th percentileScored 2026-11-07

Fix Fixed langsmith-sdk (langchain-ai): 0.6.3langsmith (PyPI): 0.6.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langchain-ai	langsmith-sdk	0.4.10 to before 0.6.3	0.6.3	Patch available	CNA
—	langsmith (PyPI)	0.4.10 to before 0.6.3	0.6.3	Patch available	GHSA-v34v-rq6j-cj6p
—	langsmith (npm)	0.3.41 to before 0.4.6	0.4.6	Patch available	GHSA-v34v-rq6j-cj6p

langsmith-sdk Vendorlangchain-ai Affected 0.4.10 to before 0.6.3 Fixed in 0.6.3 Patch available CNA
langsmith (PyPI) Vendor— Affected 0.4.10 to before 0.6.3 Fixed in 0.6.3 Patch available GHSA-v34v-rq6j-cj6p
langsmith (npm) Vendor— Affected 0.3.41 to before 0.4.6 Fixed in 0.4.6 Patch available GHSA-v34v-rq6j-cj6p

Remediation

Fix · CNA langsmith-sdk (langchain-ai) Fixed in 0.6.3
Fix · GHSA-v34v-rq6j-cj6p langsmith (PyPI) Fixed in 0.6.3 Advisory →
Fix · GHSA-v34v-rq6j-cj6p langsmith (npm) Fixed in 0.4.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-25528
2026-10-03 Alias added: GHSA-v34v-rq6j-cj6p

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-25528

Other 2

TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8

See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences