GHSA-f4xh-w4cj-qxq8

Suggest an improvement
Source
https://github.com/advisories/GHSA-f4xh-w4cj-qxq8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f4xh-w4cj-qxq8/GHSA-f4xh-w4cj-qxq8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f4xh-w4cj-qxq8
Aliases
Downstream
CGA (12)
ECHO (1)
ROOT (1)
Published
2026-06-19T22:10:34Z
Modified
2026-09-10T03:50:49Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Details

Summary

An attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary.

Impact

Confidentiality (High): arbitrary read of files accessible to the server process, exposed to anyone with workspace trace-read access.

Details

Two defects combine. A field supplied through a tracing-propagation header was merged into the run without validation, allowing injection of run attributes including attachments (CWE-346). A type check intended to gate filesystem access did not match the type of the decoded input, so the guard never engaged (CWE-843). As a result, an attacker-named file is opened by the server and uploaded as a trace attachment by the background tracing thread (CWE-22).

Who can exploit this

  • Anyone reachable by HTTP can trigger the file read. Depending on how the distributed trace system is deployed, triggering may not require authentication.
  • Retrieving the file contents requires read access to the destination LangSmith workspace. The upload uses the server's own configured API key and workspace, which the attacker cannot redirect, so a zero-access outsider cannot retrieve the result; a workspace member, or anyone who has compromised one, can.

Remediation

Upgrade the Python SDK to >= 0.8.18.

Workarounds

Until upgrading, do not expose TracingMiddleware to untrusted HTTP traffic, and limit workspace trace-read access to trusted members.

Credits

First reported by @Ryu7zz.

Database specific 
{
    "cwe_ids":  [
        "CWE-22",
        "CWE-346",
        "CWE-843"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T22:10:34Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

PyPI / langsmith

Package

Name
langsmith
View open source insights on deps.dev
Purl
pkg:pypi/langsmith

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.18

Affected versions

0.*
0.0.0rc0
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.18
0.0.19
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.30
0.0.31
0.0.32
0.0.33
0.0.34
0.0.35
0.0.36
0.0.37
0.0.38
0.0.39
0.0.40
0.0.41
0.0.42
0.0.43
0.0.44
0.0.45
0.0.46
0.0.47
0.0.48
0.0.49
0.0.50
0.0.51
0.0.52
0.0.53
0.0.54
0.0.55
0.0.56
0.0.57
0.0.58
0.0.59
0.0.60
0.0.61
0.0.62
0.0.63
0.0.64
0.0.65
0.0.66
0.0.67
0.0.68
0.0.69
0.0.70
0.0.71
0.0.72
0.0.73
0.0.74
0.0.75
0.0.76
0.0.77
0.0.78
0.0.79
0.0.80
0.0.81
0.0.82
0.0.83
0.0.84rc1
0.0.84rc2
0.0.84rc3
0.0.84rc4
0.0.84rc5
0.0.84
0.0.85
0.0.86rc1
0.0.86
0.0.87
0.0.88
0.0.89
0.0.90
0.0.91
0.0.92
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.20
0.1.21
0.1.22
0.1.23
0.1.24
0.1.25
0.1.26
0.1.27
0.1.28
0.1.29
0.1.30
0.1.31
0.1.32rc1
0.1.32rc2
0.1.32rc3
0.1.32rc4
0.1.32rc5
0.1.32rc6
0.1.32rc7
0.1.32rc8
0.1.33
0.1.34
0.1.35
0.1.36
0.1.37
0.1.38
0.1.39
0.1.40
0.1.41
0.1.42
0.1.43
0.1.44
0.1.45rc1
0.1.45
0.1.46rc1
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.51
0.1.52
0.1.53
0.1.54
0.1.55
0.1.56
0.1.57
0.1.58
0.1.59
0.1.60
0.1.61
0.1.62
0.1.63
0.1.64
0.1.65
0.1.66
0.1.67
0.1.68
0.1.69
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78
0.1.79
0.1.80
0.1.81
0.1.82
0.1.83
0.1.84
0.1.85
0.1.86
0.1.87
0.1.88
0.1.89
0.1.90
0.1.91
0.1.92
0.1.93
0.1.94
0.1.95
0.1.96
0.1.97
0.1.98
0.1.99rc1
0.1.99
0.1.100
0.1.101
0.1.102
0.1.103
0.1.104
0.1.105
0.1.106
0.1.107
0.1.108rc0
0.1.108
0.1.109
0.1.110
0.1.111
0.1.112
0.1.113
0.1.114
0.1.115rc0
0.1.115rc1
0.1.115
0.1.116rc1
0.1.116
0.1.117
0.1.118
0.1.119
0.1.120
0.1.121
0.1.122
0.1.123
0.1.124
0.1.125
0.1.126
0.1.127
0.1.128
0.1.129
0.1.130
0.1.131
0.1.132
0.1.133
0.1.134
0.1.135
0.1.136
0.1.137
0.1.138rc1
0.1.138rc2
0.1.138
0.1.139rc1
0.1.139rc2
0.1.139
0.1.140
0.1.141
0.1.142
0.1.143
0.1.144rc1
0.1.144rc2
0.1.144rc3
0.1.144
0.1.145
0.1.146
0.1.147
0.1.148rc1
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11rc1
0.2.11rc2
0.2.11rc3
0.2.11rc4
0.2.11rc5
0.2.11rc6
0.2.11rc7
0.2.11rc8
0.2.11rc9
0.2.11rc10
0.2.11rc11
0.2.11rc12
0.2.11rc13
0.2.11rc14
0.2.11rc15
0.2.11
0.3.0
0.3.1rc1
0.3.1
0.3.2
0.3.3rc0
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.3.11rc1
0.3.11
0.3.12
0.3.13
0.3.14rc0
0.3.14rc1
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18rc1
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25rc1
0.3.25rc2
0.3.25
0.3.26
0.3.27rc1
0.3.27
0.3.28rc1
0.3.28rc2
0.3.28
0.3.29rc0
0.3.29
0.3.30
0.3.31
0.3.32
0.3.33
0.3.34
0.3.35
0.3.36
0.3.37rc0
0.3.37
0.3.38
0.3.39
0.3.40
0.3.41
0.3.42
0.3.43
0.3.44
0.3.45
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.16
0.4.17
0.4.18
0.4.19
0.4.20
0.4.21
0.4.22
0.4.23
0.4.24
0.4.25
0.4.26
0.4.27
0.4.28
0.4.29
0.4.30
0.4.31
0.4.32rc0
0.4.32
0.4.33
0.4.34
0.4.35rc1
0.4.35
0.4.36
0.4.37
0.4.38
0.4.39rc0
0.4.39rc1
0.4.39
0.4.40
0.4.41
0.4.42rc0
0.4.42
0.4.43rc0
0.4.43
0.4.44
0.4.45
0.4.46
0.4.47
0.4.48
0.4.49
0.4.50
0.4.51
0.4.52
0.4.53
0.4.54rc0
0.4.54
0.4.55
0.4.56
0.4.57
0.4.58
0.4.59
0.4.60
0.5.0
0.5.1
0.5.2
0.6.0rc0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.7.10
0.7.11
0.7.12
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.20
0.7.21
0.7.22
0.7.23
0.7.24
0.7.25
0.7.26
0.7.27
0.7.28
0.7.29
0.7.30
0.7.31
0.7.32
0.7.33
0.7.34
0.7.35
0.7.36
0.7.37
0.7.38
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.8.10
0.8.11
0.8.12
0.8.14
0.8.15
0.8.16
0.8.17

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f4xh-w4cj-qxq8/GHSA-f4xh-w4cj-qxq8.json"