StackRadar

CVE-2026-59152

High

Advisory

Published 19 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.7
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
langsmithpypi0.0.87, 0.1.67, 0.1.71, 0.1.93+11 more0.8.1821
OSV records
GHSA-f4xh-w4cj-qxq8

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
langsmith@0.1.71
0.8.18

Open the chart page →

17,404
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
langsmith@0.0.87
0.8.18

Open the chart page →

11,205
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
langsmith@0.1.147
0.8.18

Open the chart page →

1,696
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
langsmith@0.6.8
0.8.18

Open the chart page →

12,907
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
langsmith@0.1.71
0.8.18

Open the chart page →

10,145
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
langsmith@0.1.93
0.8.18

Open the chart page →

4,042
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
langsmith@0.3.45
0.8.18
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
langsmith@0.6.4
0.8.18

Open the chart page →

58,897
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
langsmith@0.1.147
0.8.18

Open the chart page →

19,224
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
langsmith@0.4.47
0.8.18

Open the chart page →

2,736
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
langsmith@0.2.10
0.8.18

Open the chart page →

5,062
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
langsmith@0.3.32
0.8.18

Open the chart page →

8,405
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
langsmith@0.7.22
0.8.18

Open the chart page →

2,555
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
langsmith@0.1.67
0.8.18

Open the chart page →

18,922
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
langsmith@0.3.13
0.8.18

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
langsmith@0.3.13
0.8.18

Open the chart page →

4,718
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
langsmith@0.7.31
0.8.18

Open the chart page →

1,556
chatqnatest-opea1.0.02 of 11See more

chatqna test-opea 1.0.0

2 of the 11 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
langsmith@0.1.123
0.8.18
opea/retriever-redis:1.0eb746b263705
langsmith@0.1.123
0.8.18

Open the chart page →

39,090
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/llm-docsum-tgi:1.002f9e8fa5d71
langsmith@0.1.123
0.8.18

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
langsmith@0.1.123
0.8.18

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
langsmith@0.1.123
0.8.18

Open the chart page →

5,221
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
langsmith@0.1.123
0.8.18

Open the chart page →

5,198
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59152.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
langsmith@0.1.123
0.8.18

Open the chart page →

5,350

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opea/embedding-tei:1.05c9639de61c1
langsmith@0.1.123
0.8.18
2
opea/retriever-redis:1.0eb746b263705
langsmith@0.1.123
0.8.18
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
langsmith@0.3.13
0.8.18
2
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
langsmith@0.3.32
0.8.18
1
baserow/backend:1.31.1e0b3c8130b91
langsmith@0.1.71
0.8.18
1
baserow/baserow:1.30.1df0c42eb67e8
langsmith@0.1.71
0.8.18
1
ilum/streamlit-example:1.0.0ce5dcdeb22ba
langsmith@0.4.47
0.8.18
1
langgenius/dify-api:1.0.0066035f93856
langsmith@0.1.147
0.8.18
1
opea/guardrails-tgi:1.0262c6048aab8
langsmith@0.1.123
0.8.18
1
opea/guardrails-tgi:latestf68bec6a1271
langsmith@0.2.10
0.8.18
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
langsmith@0.1.123
0.8.18
1
opea/web-retriever-chroma:1.0fe08165d7770
langsmith@0.1.123
0.8.18
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
langsmith@0.3.45
0.8.18
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
langsmith@0.6.4
0.8.18
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
langsmith@0.1.147
0.8.18
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
langsmith@0.6.8
0.8.18
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
langsmith@0.0.87
0.8.18
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
langsmith@0.1.93
0.8.18
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
langsmith@0.7.31
0.8.18
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
langsmith@0.7.22
0.8.18
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
langsmith@0.1.67
0.8.18
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.