Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary. This vulnerability is fixed in 0.8.18.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-59152 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the Lan… https://www.cve.org/CVERecord?id=CVE-2026-59152
Post summary
The CVE affects LangSmith Client SDKs before version 0.8.18; installing version 0.8.18 or later addresses the vulnerability.
🚨*CVE* CVE-2026-59152 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the Lan… https://www.cve.org/CVERecord?id=CVE-2026-59152 ----- Traducción: CVE-2026-59152 Lan… http://infoflow.cloud`
Post summary
The post highlights CVE‑2026‑59152, noting a flaw in LangSmith SDKs before version 0.8.18 that can be triggered via HTTP requests, with an implied mitigation through upgrading past 0.8.18.