TI-2026-29805 Aliases CVE-2026-41182 GHSA-rr7j-v2q5-chgv

LangSmith SDK: Streaming token events bypass output redaction

LOW 29CWE-200Published 2026-04-23 · Updated 2026-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely — prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events. Version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00214 11th percentileScored 2026-11-07

Fix Fixed langsmith-sdk (langchain-ai): 0.5.19, 0.7.31langsmith (npm): 0.5.19+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langchain-ai	langsmith-sdk	before 0.5.19; before 0.7.31	0.5.19, 0.7.31	Patch available	CNA
—	langsmith (npm)	before 0.5.19	0.5.19	Patch available	GHSA-rr7j-v2q5-chgv
—	langsmith (PyPI)	before 0.7.31	0.7.31	Patch available	GHSA-rr7j-v2q5-chgv

langsmith-sdk Vendorlangchain-ai Affected before 0.5.19; before 0.7.31 Fixed in 0.5.19, 0.7.31 Patch available CNA
langsmith (npm) Vendor— Affected before 0.5.19 Fixed in 0.5.19 Patch available GHSA-rr7j-v2q5-chgv
langsmith (PyPI) Vendor— Affected before 0.7.31 Fixed in 0.7.31 Patch available GHSA-rr7j-v2q5-chgv

Remediation

Fix · CNA langsmith-sdk (langchain-ai) Fixed in 0.5.19, 0.7.31
Fix · GHSA-rr7j-v2q5-chgv langsmith (npm) Fixed in 0.5.19 Advisory →
Fix · GHSA-rr7j-v2q5-chgv langsmith (PyPI) Fixed in 0.7.31 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41182
2026-10-03 Alias added: GHSA-rr7j-v2q5-chgv

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41182

Other 2

TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8

See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences