{"schemaVersion":3,"id":"CVE-2026-25528","aliases":["GHSA-v34v-rq6j-cj6p","PYSEC-2026-2584","CGA-24gc-qffh-93p9","CGA-5h8j-r2w6-wqfc","CGA-6crr-jwcx-3qq8","CGA-f62x-6pg3-83mg","CGA-gxc6-r7f5-qr9m","CGA-gxr3-9c37-cwmx","CGA-wjqj-jchj-9xwc","CGA-xw54-p6qp-v25v","CGA-22f5-f468-c8c3","CGA-28c9-27m8-vqjf","CGA-298f-2c7w-qmp9","CGA-2qqx-72g5-r9v9","CGA-2wjq-4wx4-hppw","CGA-2ww7-6g97-4g3q","CGA-32fv-pg37-pm99","CGA-33fc-x5r8-7w8f","CGA-364v-c6r5-5frh","CGA-39cr-9mrq-6f82","CGA-3cjm-r2mp-vxg3","CGA-3fhg-w3qm-gjrv","CGA-3hcr-7j2j-69x9","CGA-3rm8-5rvv-93vp","CGA-3wmr-c5cf-cv2f","CGA-47fw-5v5r-6rw5","CGA-47gj-73q2-phhw","CGA-4r6m-9m4p-rv5h","CGA-59hg-24f9-m4jq","CGA-5g4x-crjm-27w2","CGA-626f-wv5q-h4pm","CGA-6472-r2h2-gqm6","CGA-67c5-hpv9-6ccc","CGA-6jp9-rpwp-7r4j","CGA-6pw9-7m83-2886","CGA-77c9-xfpf-mv5f","CGA-7hcj-cp4g-c2r7","CGA-7mmr-xm9v-3jg6","CGA-7pcj-8rqr-2q8f","CGA-85jm-7rqh-ppf5","CGA-8fvv-3447-33pj","CGA-8w9q-qjvp-p8cr","CGA-95gm-7647-3rqx","CGA-963c-646r-q36x","CGA-98q8-v5m6-c4p5","CGA-99fq-8xv6-67rg","CGA-9hf5-2cj2-vxf2","CGA-9rmj-xmv8-f7mx","CGA-c5pp-m2m2-547r","CGA-crcv-q983-52m8","CGA-cvcc-mcj3-fwv4","CGA-cw9g-vh6f-pxpf","CGA-cx9j-f2wr-fm55","CGA-f329-53pc-hwm4","CGA-f44p-gq72-g938","CGA-f8q5-5rgc-5626","CGA-fc8j-26qf-q3cp","CGA-fmc2-jc7f-98hq","CGA-g37h-v3qx-444g","CGA-g485-rxg8-vgmq","CGA-ghf4-6mf8-4j93","CGA-gx2p-hjhq-hq2j","CGA-h3rh-c366-482q","CGA-h56q-rcfv-fh9g","CGA-hch6-wv4v-8558","CGA-hw4m-m4qq-4gg9","CGA-j5fw-ppgf-5r85","CGA-j6mc-52q3-c9xm","CGA-jfmw-f6vw-8448","CGA-jqgc-759g-27gf","CGA-m8m8-j922-9224","CGA-m9xc-3fxf-g35r","CGA-mgw9-v97f-mpv9","CGA-mr74-f3gf-rxf6","CGA-p7cq-3gpm-4h2p","CGA-pc6j-q4vx-78m6","CGA-pqq4-m237-f28p","CGA-prgj-6hhm-7pgc","CGA-pvh5-c74m-5xv5","CGA-pvhq-gm2r-34p4","CGA-q5m7-h2c7-x5r2","CGA-qgrc-4fq6-p79v","CGA-qhv7-p79w-4rhx","CGA-qjv7-cxhf-8qg6","CGA-qww6-mv3v-ccvg","CGA-rg87-mfqg-7qfw","CGA-rm82-h8fg-h838","CGA-rrp5-f7jc-55mm","CGA-v55x-734v-xwg6","CGA-vqh5-8rv7-pm3m","CGA-w62x-5fr8-vhq3","CGA-wc68-p3c9-54gh","CGA-wf92-gr4c-629v","CGA-wfrp-crp7-x4pf","CGA-wr82-mcw9-hvq9","CGA-x26w-c4mr-xpxm","CGA-x92g-gq2c-mw2g","CGA-x9qm-gp85-9rr5","CGA-xp83-545x-hcp5","CGA-xvr9-qx9m-crwq"],"status":"published","duplicateOf":null,"title":null,"description":"LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and  0.4.6 of the JavaScript SDK.","dates":{"published":"2026-02-09T20:08:32.903Z","modified":"2026-02-10T15:59:49.992Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00363,"percentile":0.2871,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.07,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00293},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00363,"percentile":0.2871}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00293,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00325,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00363,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00363,"percentile":0.2871}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"chainguard","product":"kibana-8.17","name":"kibana-8.17","label":"kibana-8.17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17","purlType":"apk","versions":[{"text":"< 8.17.10-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-iamguarded","name":"kibana-8.17-iamguarded","label":"kibana-8.17-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-iamguarded","purlType":"apk","versions":[{"text":"< 8.17.10-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18","name":"kibana-8.18","label":"kibana-8.18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-bitnami","name":"kibana-8.18-bitnami","label":"kibana-8.18-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-bitnami","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-iamguarded","name":"kibana-8.18-iamguarded","label":"kibana-8.18-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.11-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.19.14-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.11-r1 | < 8.19.14-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.14-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.14-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.14-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.19.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.14-r1 | < 8.19.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.5-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 9.2.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.5-r4 | < 9.2.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.5-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 9.2.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.5-r4 | < 9.2.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.153.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.153.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.153.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.153.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.3-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 0.8.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.3-r0 | < 0.8.2-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.153.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.153.0-r2","eol":null,"hubHref":null},{"vendor":"langchain-ai","product":"langsmith-sdk","name":"langsmith-sdk","label":"langsmith-sdk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.4.10, < 0.6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.4.10, < 0.6.3","eol":null,"hubHref":"/vendor/langchain-ai/langsmith-sdk"},{"vendor":"Npm","product":"langsmith","name":"langsmith","label":"langsmith","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/langsmith","purlType":"npm","versions":[{"text":"≥ 0.3.41, < 0.4.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.3.41, < 0.4.6","eol":null,"hubHref":null},{"vendor":"PyPI","product":"langsmith","name":"langsmith","label":"langsmith","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/langsmith","purlType":"pypi","versions":[{"text":"≥ 0.4.10, < 0.6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.4.10, < 0.6.3","eol":null,"hubHref":null}],"affectedCount":26,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p","label":"github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25528","label":"nvd.nist.gov/vuln/detail/CVE-2026-25528","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/langchain-ai/langsmith-sdk","label":"github.com/langchain-ai/langsmith-sdk","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://pypi.org/project/langsmith","label":"pypi.org/project/langsmith","hostname":"pypi.org","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-v34v-rq6j-cj6p","label":"github.com/advisories/GHSA-v34v-rq6j-cj6p","hostname":"github.com","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25528.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25528.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-3MHF-VGH6-9VG5"]},"timeline":[{"kind":"published","date":"2026-02-09T20:08:32.903Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-10T15:59:49.992Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":23,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T06:32:34.450Z","stale":false,"partial":false}}