{"data":{"ecosystem":"npm","name":"langsmith","url":"https://aisecwatch.com/packages/npm/langsmith","latestVersion":"0.10.11","firstReleaseAt":"2023-06-26T22:00:11.934Z","repository":"https://github.com/langchain-ai/langsmith-javascript","llm":{"exposure":"none","depth":null,"integratedAt":null,"integratedVersion":null,"sdks":[],"path":[]},"authority":{"profile":[],"fromDependencies":[]},"dependencies":[{"ecosystem":"npm","name":"p-queue","versionSpec":"6.6.2","scope":"runtime"}],"advisories":[{"id":"2b867898-226e-41b1-bb5e-0fdbe00009b4","url":"https://aisecwatch.com/issues/2b867898-226e-41b1-bb5e-0fdbe00009b4","cveId":null,"title":"GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read","severity":"high","publishedAt":"2026-06-19T22:10:34.000Z","affected":["langsmith@< 0.8.18 (fixed: 0.8.18)"],"epssScore":null},{"id":"51fb1fdb-be21-4f50-8ce9-9dcd9036cf68","url":"https://aisecwatch.com/issues/51fb1fdb-be21-4f50-8ce9-9dcd9036cf68","cveId":"CVE-2026-45134","title":"GHSA-3644-q5cj-c5c7: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning","severity":"high","publishedAt":"2026-05-13T15:29:30.000Z","affected":["langchain@< 0.3.30 (fixed: 0.3.30)","langchain-classic@< 1.0.7 (fixed: 1.0.7)","langsmith@< 0.6.0 (fixed: 0.6.0)","langsmith@< 0.8.0 (fixed: 0.8.0)"],"epssScore":0.00344},{"id":"405115eb-9c98-4ab8-b561-3ab4a5551fa8","url":"https://aisecwatch.com/issues/405115eb-9c98-4ab8-b561-3ab4a5551fa8","cveId":null,"title":"GHSA-rr7j-v2q5-chgv: LangSmith SDK: Streaming token events bypass output redaction","severity":"medium","publishedAt":"2026-04-16T01:20:37.000Z","affected":["langsmith@<= 0.7.30 (fixed: 0.7.31)","langsmith@<= 0.5.18 (fixed: 0.5.19)"],"epssScore":null},{"id":"c1a405aa-3c42-4207-b47e-4454273b9bf8","url":"https://aisecwatch.com/issues/c1a405aa-3c42-4207-b47e-4454273b9bf8","cveId":"CVE-2026-40190","title":"GHSA-fw9q-39r9-c252: LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`","severity":"medium","publishedAt":"2026-04-10T20:18:02.000Z","affected":["langsmith@<= 0.5.17 (fixed: 0.5.18)"],"epssScore":0.00385}],"checkedAt":"2026-10-09T21:52:16.317Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}