Vulnerabilities

 1 via 1 paths

Dependencies

 197

Source

 GitHub

Commit

 15e95bbc

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

Server-side Request Forgery (SSRF)

  • Vulnerable module: langsmith
  • Introduced through: langchain@0.3.37

Detailed paths

  • Introduced through: mysql-gui@kshashikumar/mysql-gui#15e95bbc7246007ef99e7046e0caf8ff49132d33 › langchain@0.3.37 › langsmith@0.3.87
    Remediation: Upgrade to langchain@1.0.1.

Overview

langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the improper validation of api_url and api_key fields in baggage headers in RunTree.from_headers() and RunTree.fromHeaders() functions. An attacker can cause the exfiltration of sensitive trace data to attacker-controlled endpoints by injecting arbitrary api_url values through the baggage header, which are then used by the SDK to send run data to malicious URLs.

Note:

This issue affects applications, utilising TracingMiddleware and calling RunTree.from_headers() or RunTree.fromHeaders() with untrusted HTTP headers.

Workaround

For users that are unable to upgrade to the fixed version it is recommended:

  • To strip or validate the baggage header before passing to RunTree.from_headers() or RunTree.fromHeaders();
  • To not use TracingMiddleware with untrusted traffic.

Remediation

Upgrade langsmith to version 0.4.6 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report