Executive brief
LangSmith SDK is a library used by developers to trace and monitor Large Language Model (LLM) application behavior. The SDK's distributed tracing feature accepts untrusted HTTP headers that can be manipulated to inject malicious URLs. An attacker can force the SDK to send sensitive application data—including LLM prompts, outputs, and metadata—to attacker-controlled servers, enabling data theft and internal network probing.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in the SDK's distributed tracing feature, specifically in the RunTree.from_headers() (Python) and RunTree.fromHeaders() (TypeScript) functions. These functions parse the baggage HTTP header without validating the api_url and api_key fields, allowing an attacker to inject arbitrary replica URLs. When a traced operation completes, the SDK sends run data (including LLM inputs, outputs, and metadata) to all configured replicas, including attacker-injected endpoints. The attack requires no privileges or user interaction—any application using TracingMiddleware or calling from_headers() with untrusted HTTP headers is vulnerable. Patches are available: Python ≥0.6.3 and TypeScript ≥0.4.6 remove credential fields from parsed replica configurations via an allowlist mechanism.
Affected products
- LangChain LangSmith SDK Python >=0.4.10, <0.6.3; TypeScript >=0.3.41, <0.4.6
Timeline
- 2026-02-09: disclosed: GHSA-v34v-rq6j-cj6p and CVE-2026-25528 published
- 2026-02-09: patched: Python 0.6.3 and TypeScript 0.4.6 released with fix