Vulnerabilities for langsmith

First version without a known vulnerability: 0.8.18

Details

• GHSA-f4xh-w4cj-qxq82026-06-19

  LangSmith SDK TracingMiddleware: Arbitrary server-side file read

  Fixed in: 0.8.18

• GHSA-3644-q5cj-c5c72026-05-13

  LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

  Fixed in: 0.8.0, 0.6.0, 1.0.7, 0.3.30

• GHSA-rr7j-v2q5-chgv2026-04-16

  LangSmith SDK: Streaming token events bypass output redaction

  Fixed in: 0.5.19, 0.7.31

• GHSA-v34v-rq6j-cj6p2026-02-09

  LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

  Fixed in: 0.6.3, 0.4.6