What’s Vulnerable › Products

langchain-ai langsmith-sdk vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your langchain-ai langsmith-sdk version is affected

Latest langchain-ai langsmith-sdk vulnerabilities

• CVE-2026-59152 — Arbitrary server-side file read in LangSmith SDK TracingMiddleware (CVSS 5.0)
• CVE-2026-45134 — LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning (CVSS 7.1)
• CVE-2026-41182 — LangSmith SDK: Streaming token events bypass output redaction (CVSS 5.3)
• CVE-2026-40190 — LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()` (CVSS 9.8)
• CVE-2026-25750 — LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl (CVSS 8.1)
• CVE-2026-25528 — LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection (CVSS 5.8)