{"id":"CVE-2026-41182","aliases":["GHSA-rr7j-v2q5-chgv","PYSEC-2026-2583"],"title":"LangSmith SDK: Streaming token events bypass output redaction","summary":"LangSmith SDK: Streaming token events bypass output redaction","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"langsmith","product":"langsmith","ecosystem":"npm","affected":["langsmith < 0.5.19","langsmith < 0.7.31"],"patched":["langsmith 0.5.19","langsmith 0.7.31"],"published":"2026-04-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:03.075090864Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rr7j-v2q5-chgv","references":[{"url":"https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41182"},{"url":"https://github.com/langchain-ai/langsmith-sdk"}],"tags":["osv","npm"],"epss":0.00214,"epssPercentile":0.12067,"ingestedAt":"2026-07-13T18:58:02.925Z","slug":"CVE-2026-41182","body":"## Overview\n\n## Summary\n\nThe LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely — prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events.\n\n## Details\n\n**Both JS and Python SDKs are affected.** The same pattern exists in both:\n\n- **JS SDK**: `traceable.ts:997-1003` and `traceable.ts:1044-1050`\n- **Python SDK**: `run_helpers.py:1924` and `run_helpers.py:1996`\n\nIn both SDKs, `new_token` events with raw `kwargs.token` values are added during streaming, and the redaction pipeline (`hideOutputs` in JS, `hide_outputs` in Python) only processes `inputs`/`outputs` — never `events`.\n\n## Affected packages\n\n- `langsmith < 0.5.19`\n- `langsmith < 0.7.31`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `langsmith 0.5.19`\n- `langsmith 0.7.31`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}