Langchain Helm Charts 注入漏洞

Langchain Helm Charts is a Kubernetes Helm chart library developed by LangChain for deploying Langchain applications. Versions of Langchain Helm Charts prior to 0.12.71 contained a injection vulnerability. This vulnerability stemmed from URL parameter injections in LangSmith Studio, which could...

CVE-2026-25528

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

CVE-2026-25528

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

Server-side Request Forgery (SSRF)

Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the improper validation of apiurl and apikey fields in baggage headers in RunTree.fromheaders and...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2113 more potentially affected by CVE-2026-25528 via langsmith (>=0.3.71, <=0.3.87)

langsmith NPM version =0.3.71, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =2.0.0, =2.2.0 - @adb-storage-m/mem0ai 2.3.2 and more Source cves: CVE-2026-25528 Source advisory: SNYK:JS-LANGSMITH-15253025...

agent-api-server (>=2.1.7, <=2.1.13), ai-infra (>=0.1.3, <=0.1.136) +19 more potentially affected by CVE-2026-25528 via langsmith (>=0.4.10, <=0.6.2)

langsmith PYPI version =0.4.10, =2.1.7, =0.1.3, =3.0.0, =0.3.1, =1.0.2, =0.1.0, =0.2.1, =2.1.21, =0.2.1, =1.0.0, =0.3.2, =0.4.1 - opea-comps 1.5.0 and more Source cves: CVE-2026-25528 Source advisory: SNYK:PYTHON-LANGSMITH-15253026...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2113 more potentially affected by CVE-2026-25528 via langsmith (>=0.3.71, <=0.3.87)

langsmith NPM version =0.3.71, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =2.0.0, =2.2.0 - @adb-storage-m/mem0ai 2.3.2 and more Source cves: CVE-2026-25528 Source advisory: OSV:GHSA-V34V-RQ6J-CJ6P...

agent-api-server (>=2.1.7, <=2.1.13), ai-infra (>=0.1.3, <=0.1.136) +19 more potentially affected by CVE-2026-25528 via langsmith (>=0.4.10, <=0.6.2)

langsmith PYPI version =0.4.10, =2.1.7, =0.1.3, =3.0.0, =0.3.1, =1.0.2, =0.1.0, =0.2.1, =2.1.21, =0.2.1, =1.0.0, =0.3.2, =0.4.1 - opea-comps 1.5.0 and more Source cves: CVE-2026-25528 Source advisory: OSV:GHSA-V34V-RQ6J-CJ6P...

agent-api-server (>=2.1.7, <=2.1.13), ai-infra (>=0.1.3, <=0.1.136) +19 more potentially affected by CVE-2026-25528 via langsmith (>=0.4.10, <=0.6.2)

langsmith PYPI version =0.4.10, =2.1.7, =0.1.3, =3.0.0, =0.3.1, =1.0.2, =0.1.0, =0.2.1, =2.1.21, =0.2.1, =1.0.0, =0.3.2, =0.4.1 - opea-comps 1.5.0 and more Source cves: CVE-2026-25528 Source advisory: GHSA-V34V-RQ6J-CJ6P...

GHSA-V34V-RQ6J-CJ6P LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

Summary The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. ---...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2113 more potentially affected by CVE-2026-25528 via langsmith (>=0.3.71, <=0.3.87)

langsmith NPM version =0.3.71, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =2.0.0, =2.2.0 - @adb-storage-m/mem0ai 2.3.2 and more Source cves: CVE-2026-25528 Source advisory: GHSA-V34V-RQ6J-CJ6P...

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

Summary The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. ---...

agent-api-server (>=2.1.7, <=2.1.13), ai-infra (>=0.1.3, <=0.1.136) +19 more potentially affected by CVE-2026-25528 via langsmith (>=0.4.10, <=0.6.2)

langsmith PYPI version =0.4.10, =2.1.7, =0.1.3, =3.0.0, =0.3.1, =1.0.2, =0.1.0, =0.2.1, =2.1.21, =0.2.1, =1.0.0, =0.3.2, =0.4.1 - opea-comps 1.5.0 and more Source cves: CVE-2026-25528 Source advisory: MEND:CVE-2026-25528...

CVE-2026-25528 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

CVE-2026-25528

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

CVE-2026-25528 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

CVE-2026-25528 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

LangSmith Client SDKs 代码问题漏洞

LangSmith Client SDKs are a developer toolkit open-sourced by LangChain. Versions of LangSmith Client SDKs prior to 0.6.3 and 0.4.6 contained code vulnerabilities. These vulnerabilities stemmed from the distributed tracking feature not verifying HTTP headers, which could lead to server-side reque...

CVE-2026-25528: Server-Side Request Forgery (SSRF)

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary apiurl values through the baggage header, causing the SDK to...

AgentSmith Flaw in LangSmith’s Prompt Hub Exposed User API Keys, Data

A CVSS 8.8 AgentSmith flaw in LangSmith's Prompt Hub exposed AI agents to data theft and LLM manipulation. Learn how malicious AI agents could steal API keys and hijack LLM responses. Fix deployed...