The vulnerability is a server‑side request forgery in the LangSmith client SDK’s distributed tracing feature. An attacker can inject malicious values into the baggage HTTP header, specifically the api_url field, which the SDK parses without validation. When a traced operation completes, the SDK sends run data to all configured replica URLs. If an attacker supplies an arbitrary api_url, trace data, including potentially sensitive information, is exfiltrated to the attacker’s endpoint. This results in a confidentiality compromise of trace data.

Affected products are the LangSmith client SDKs provided by langchain-ai for Python and JavaScript. Versions prior to 0.6.3 for Python and prior to 0.4.6 for JavaScript are impacted. The flaw exists in the RunTree.from_headers() (Python) and RunTree.fromHeaders() (Typescript) code used when distributed tracing is enabled.

The CVSS score is 5.8, indicating medium severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is via a client that has network access to the LangSmith service; an attacker who can influence the baggage header sent to the SDK can cause it to contact arbitrary endpoints, leading to data exfiltration. Exploitation requires the SDK to be running with distributed tracing enabled and the attacker to supply a malicious api_url in the baggage header. No known workarounds are available beyond disabling distributed tracing.