attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith (CVE-2026-16725)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith due to a flaw in LangSmith SDK's TracingMiddleware that allows the server into accept a malicious HTTP request, reading a file from its local filesystem and uploading the contents to LangSmith as a trace...

ROOT-APP-PYPI-CVE-2026-45134 CVE-2026-45134 in langsmith - Patched by Root

Root has patched CVE-2026-45134 in the langsmith package for Root:PyPI. Multiple fixed versions available...

Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub

Summary Multiple vulnerabilities were addressed in IBM Engineering AI Hub version 1.4.0. Vulnerability Details CVEID:CVE-2026-59152 DESCRIPTION: LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server...

CVE-2026-45134

A flaw was found in the LangSmith Client SDKs. This vulnerability allows an external attacker to control the content of prompt manifests when a user pulls a public prompt from the LangSmith Hub. By exploiting the deserialization of untrusted data, an attacker could achieve high confidentiality...

LangSmith / Langfuse Key Abuse

Uses leaked LangSmith lsv2 or Langfuse lfpk/lfsk keys to query observability APIs for traces and sessions. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked LangSmith and Langfuse API keys to access traces and sessions.""" from kittysploit import from...

ROOT-APP-PYPI-GHSA-RR7J-V2Q5-CHGV GHSA-rr7j-v2q5-chgv in langsmith - Patched by Root

Root has patched GHSA-rr7j-v2q5-chgv in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in langsmith - Patched by Root

Root has patched GHSA-f4xh-w4cj-qxq8 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root

Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...

LangSmith Panel - Detect

LangSmith panel was detected. LangSmith is LangChain's platform for debugging, testing, evaluating, and monitoring LLM applications. !/usr/bin/env python3 -- coding: utf-8 -- """LangSmith panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith [CVE-2026-45134]

Summary IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangSmith, due to issues with an earlier version of the SDK's prompt pull methods and deserialize prompt manifests from the LangSmith Hub CVE-2026-45134. LangSmith is used in our runtime...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith [CVE-2026-41182]

Summary IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith, due to an issue that causes a bypass of the redaction pipeline CVE-2026-41182. LangSmith is used in our runtime postprocessor. This vulnerability has been addressed. Please read the details...

OPENSUSE-SU-2026:11284-1 python313-langsmith-0.10.3-1.1 on GA media

These are all security issues fixed in the python313-langsmith-0.10.3-1.1 package on the GA media of openSUSE Tumbleweed...

PYSEC-2026-2560 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Description The LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

DescriptionThe LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1449 more potentially affected by CVE-2026-45134 via langsmith (>=0.0.5, <=0.7.38)

langsmith PYPI version =0.0.5, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =0.1.0, =0.1.1, =2.1.7, =0.1.1, =0.1.3 and more Source cves: CVE-2026-45134 Source advisory: OSV:PYSEC-2026-2582...

PYSEC-2026-2555 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Description The LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

DescriptionThe LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

LangSmith SDK: Streaming token events bypass output redaction

SummaryThe LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a newtoken event containing the raw token value. These events bypass the redaction pipeline...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1448 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.7.22)

langsmith PYPI version =0.0.5, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =0.1.0, =0.1.1, =2.1.7, =0.1.1, =0.1.3 and more Source cves: CVE-2026-41182 Source advisory: OSV:PYSEC-2026-2583...