Executive brief
A vulnerability in the LangSmith SDK's tracing middleware allows an attacker to force a server to read sensitive files from its local storage. These files are then uploaded as attachments to the LangSmith monitoring workspace. While any web user can trigger the file read, only individuals with access to the organization's LangSmith workspace (such as employees or contractors) can actually view the stolen file contents.
Technical details
The vulnerability arises from two combined defects in the LangSmith SDK's TracingMiddleware. First, a field supplied via a tracing-propagation header is merged into the execution run without validation, allowing for the injection of run attributes like attachments (CWE-346). Second, a type check designed to restrict filesystem access fails because it does not match the type of the decoded input (CWE-843). An attacker can exploit this by sending a crafted HTTP request to a reachable server, causing it to open a local file and upload it as a trace attachment (CWE-22). While the read is triggered via the network, retrieving the file requires read access to the destination LangSmith workspace. The issue is fixed in Python SDK version 0.8.18.
Affected products
- LangChain langsmith < 0.8.18
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: Fixed in version 0.8.18
- 2026-06-19: advisory