Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The LangSmith SDK's prompt pull methods (pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. Prompt manifests can intentionally configure a model with a custom base URL, default headers, model name, or other constructor arguments. These are supported features, but they also mean the prompt contents should be treated as executable configuration rather than plain text. A prompt can also include serialized LangChain Runnable or PromptTemplate objects with attacker-controlled constructor kwargs, or secret references that, if secretsfromenv is enabled,…
Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The LangSmith SDK's output redaction controls (hideOutputs in JS, hideoutputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a newtoken event containing the raw token value. These events bypass the redaction pipeline entirely — prepareRunCreateOrUpdateInputs (JS) and hiderunoutputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events. Details Both JS and Python SDKs are affected. The same pattern exists in both: - JS SDK: traceable.ts:997-1003 and traceable.ts:1044-1050 - Python SDK: runhelpers.py:1924 and runhelpers.py:1996 In both SDKs, newtoken events with raw kwargs.token values are added during streaming, and the redaction pipeline (hideOutputs in JS, hideoutputs in Python) only processes…
Recommended action: Upgrade to 0.5.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GHSA-fw9q-39r9-c252: Prototype Pollution via Incomplete Lodash set() Guard in langsmith-sdk Severity: Medium (CVSS ~5.6) Status: Fixed in 0.5.18 --- Summary The LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the proto key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. --- Affected Products | Product | Affected Versions | Component | |---------|-------------------|-----------| | langsmith (npm) | <= 0.5.17 | js/src/utils/lodash/baseAssignValue.ts, js/src/anonymizer/index.ts | | langchain-ai/langsmith-sdk | GitHub main branch (as of 2026-03-24) | JS/TypeScript SDK | Not affected: The Python SDK (langsmith on PyPI) does not use lodash or an equivalent pattern. ---…
Recommended action: Upgrade to 0.5.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. --- Description When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.fromheaders() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including apiurl and apikey fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. --- Attack Vector 1. Attacker sends an HTTP request to a vulnerable service with a malicious baggage header: 2. The service parses the header via RunTree.fromheaders(), storing the attacker's URL 3. When the traced…
Recommended action: Upgrade to 0.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.