https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for langchain-ai/langchain en-us Tue, 11 Aug 2026 21:01:38 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/373 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/373 Wed, 05 Aug 2026 21:38:57 GMT The evaluation runner copied the Git remote URL verbatim into LangSmith run tags without stripping embedded credentials (userinfo) from HTTPS or SSH-style URLs. If a developer's local git remote contained an access token or password (e.g., `https://user:token@github.com/...`), that secret would be persisted and exposed in run metadata/tags, which may be visible to other users or logged systems. The patch adds sanitization that strips userinfo while preserving host/path identity, and fails closed (omitting the tag) for ambiguous or malformed URLs. medium verified