GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read

Summary

A flaw in the LangSmith SDK's TracingMiddleware lets an attacker who can send HTTP requests to a server running it make that server read an arbitrary local file and upload the contents to LangSmith as a trace attachment. Retrieving the contents requires read access to the destination LangSmith workspace, and triggering the read may not require authentication, depending on deployment. The flaw combines an unvalidated tracing-propagation header field (CWE-346), a type check that never engages (CWE-843), and a path traversal read (CWE-22).

Mitigation

Upgrade the Python SDK to `>= 0.8.18`. Until upgrading, do not expose `TracingMiddleware` to untrusted HTTP traffic, and limit workspace trace-read access to trusted members.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langsmithPyPILLM dependency since 2025-03-14 · 10 tracked dependents

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database