https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:39:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-59152 <p><strong>Affected:</strong> langchain-ai langsmith-sdk</p> <p>LangSmith Client SDKs provide SDK&#39;s for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK&#39;s TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace&#39;s intended trust boundary. This vulnerability is fixed in 0.8.18.</p> <p><strong>Affected:</strong> langchain-ai langsmith-sdk</p> <p>LangSmith Client SDKs provide SDK&#39;s for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK&#39;s TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace&#39;s intended trust boundary. This vulnerability is fixed in 0.8.18.</p> https://cve.radiocsirt.org/vuln/cve-2026-59152