What is the CVSS score of CVE-2026-59152?

CVE-2026-59152 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-59152?

Yes, a patch is available for CVE-2026-59152. Update the affected software to the latest version immediately.

LangSmith SDK CVE-2026-59152

EUVD-2026-41879 MEDIUM

Path Traversal (CWE-22)

2026-07-06 GitHub_M

Path Traversal Red Hat Langsmith Sdk Langchain Ai

5.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

7.7 HIGH

Arbitrary server file read warrants C:H - practical targets include SSH keys, .env secrets, and TLS certs despite the PR:L workspace access gate.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 17:01 EUVD

Analysis Generated

Jul 06, 2026 - 16:53 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 pypi packages depend on langsmith (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.8.18.

DescriptionCVE.org

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary. This vulnerability is fixed in 0.8.18.

AnalysisAI

Path traversal in LangSmith Client SDK's TracingMiddleware (versions prior to 0.8.18) enables a trust-boundary crossing where any party with LangSmith workspace trace-read access can exfiltrate arbitrary files from servers running the middleware. An attacker sends a crafted HTTP request to a TracingMiddleware-instrumented server, causing it to read a local filesystem path and upload the contents to LangSmith as a trace attachment, which the attacker then retrieves via their workspace access. No public exploit has been identified at time of analysis, but the low complexity and broadly scoped file read make this a meaningful risk for any multi-tenant or contractor-accessible LangSmith deployment.

Technical ContextAI

The LangSmith SDK (CPE: cpe:2.3:a:langchain-ai:langsmith-sdk:*:*:*:*:*:*:*:*) is a Python observability library providing TracingMiddleware for instrumenting web servers to emit execution traces to the LangSmith platform. The root cause is CWE-22 (Path Traversal): the middleware fails to sanitize user-controlled input in incoming HTTP requests before using it to construct local filesystem paths, permitting traversal sequences such as ../../etc/passwd or ../../app/.env to reference files outside any intended scope. The middleware then reads the targeted file and uploads its contents to LangSmith as a trace attachment, a legitimate feature repurposed as an exfiltration channel. The CVSS Scope:Changed metric correctly models the trust boundary violation - a workspace user's read privileges extend, without authorization, to the filesystem of any server running the middleware.

RemediationAI

Upgrade to LangSmith SDK version 0.8.18 or later, which resolves the path traversal per the vendor-released fix confirmed in GitHub Security Advisory GHSA-f4xh-w4cj-qxq8 (https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-f4xh-w4cj-qxq8). If immediate patching is not feasible, remove or disable TracingMiddleware from any service reachable by untrusted network clients - note this disables LangSmith tracing for those services, which may affect observability. Audit and restrict LangSmith workspace trace-read permissions to fully trusted users only, since any workspace member with this permission can retrieve exfiltrated file contents; revoking access from contractors or low-privilege accounts closes the retrieval path even if a malicious request is sent. On containerized deployments, applying read-only filesystem mounts or restrictive seccomp/AppArmor profiles limits what files the server process - and therefore the middleware - can access, reducing blast radius if patching is delayed.