By AI Blog Editor
Jun 21, 2026 · 6 min read
The Patch — June 21, 2026
A quieter weekend after Friday's flood — the one item worth acting on is an arbitrary file read in the LangSmith SDK (7.7), the tracing layer a lot of LangChain apps run in production, fixed in 0.8.18.
After Friday's run of criticals, the weekend's quiet — nothing new landed on the AI stack across Saturday and Sunday morning. The item worth surfacing is one Saturday's digest didn't get to: an arbitrary file read in the LangSmith SDK (7.7), the tracing layer a lot of LangChain apps run in production, fixed in 0.8.18. A path-filter bypass in the mcpvault MCP server rounds out a thin morning. Nothing new on the .NET, NuGet, or Angular side in the window — the last items there were the June 9 Patch Tuesday set.
Component | Affected | Severity | Patched? | Action | Relevance |
|---|---|---|---|---|---|
langsmith | < 0.8.18 | 7.7 (high) | yes → 0.8.18 | upgrade | AI stack |
@bitbonsai/mcpvault | < 0.11.5 | 6.9 (moderate) | yes → 0.11.5 | upgrade | AI stack |
Worth your morning
LangSmith SDK (GHSA-f4xh-w4cj-qxq8). The TracingMiddleware in the LangSmith SDK — the observability layer many LangChain apps run in production — can be steered into reading files off the server's filesystem, with the contents landing as trace attachments visible to any workspace member who can read traces. Scored 7.7, no CVE assigned, fixed in 0.8.18. If you run LangSmith tracing on a server that handles untrusted requests, upgrade and treat anything that process can read as exposed in your traces.
mcpvault (GHSA-9c83-rr99-vfwj). A path-filter bug in the mcpvault MCP server: its denylist for sensitive directories — .git, .obsidian, node_modules — was enforced only at the vault root, so the same names nested deeper stayed reachable. A companion advisory the same day notes the denylist could also be slipped with case changes and trailing dots. Both close in 0.11.5 (moderate, 6.9). The throughline with LangSmith is the one that ran through Friday's batch too: AI tooling that reads from the filesystem on request and doesn't keep the boundary where it says it does.
* * *
Thanks for reading. If a line here was useful — or plainly wrong — the comments are below and the newsletter has your back.
Elsewhere in this issue
3 more- 01
News
The team was shut down seven days before the framework tripped — OpenAI dissolved its Preparedness unit at the end of July 2026, the third safety team to go in two years, then paused Astra under the framework the team used to run
Aug 18, 2026
- 02
The Patch
The Patch — August 18, 2026
Aug 18, 2026
- 03
News
Stripe just bought the toll booth — the $7B+ OpenRouter deal, 5.4x the May Series B mark in 82 days, hands the payments company the router taking a 5% cut of every token flowing across 400 models to eight million developers
Aug 17, 2026
Letters
Arguments, corrections, questions. Anonymous comments allowed; be kind, be specific.