CVE-2026-41182

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41182", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T16:34:45.526Z", "datePublished": "2026-04-23T00:14:20.964Z", "dateUpdated": "2026-04-23T16:23:39.037Z"}, "containers": {"cna": {"title": "LangSmith SDK: Streaming token events bypass output redaction", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-359", "lang": "en", "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv"}], "affected": [{"vendor": "langchain-ai", "product": "langsmith-sdk", "versions": [{"version": "< 0.5.19", "status": "affected"}, {"version": "< 0.7.31", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-23T00:14:20.964Z"}, "descriptions": [{"lang": "en", "value": "LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events. Version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK fix the issue."}], "source": {"advisory": "GHSA-rr7j-v2q5-chgv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T14:22:03.787610Z", "id": "CVE-2026-41182", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T16:23:39.037Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41182", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T14:22:03.787610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T14:22:13.647Z"}}], "cna": {"title": "LangSmith SDK: Streaming token events bypass output redaction", "source": {"advisory": "GHSA-rr7j-v2q5-chgv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "langchain-ai", "product": "langsmith-sdk", "versions": [{"status": "affected", "version": "< 0.5.19"}, {"status": "affected", "version": "< 0.7.31"}]}], "references": [{"url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv", "name": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events. Version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK fix the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-359", "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-23T00:14:20.964Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41182", "state": "PUBLISHED", "dateUpdated": "2026-04-23T16:23:39.037Z", "dateReserved": "2026-04-17T16:34:45.526Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-23T00:14:20.964Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "langsmith-sdk", "vendor": "langchain-ai", "versions": [{"status": "affected", "version": "< 0.5.19"}, {"status": "affected", "version": "< 0.7.31"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events. Version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK fix the issue."}, {"lang": "es", "value": "Los SDKs de cliente de LangSmith proporcionan SDKs para interactuar con la plataforma LangSmith. Antes de la versi\u00f3n 0.5.19 del SDK de JavaScript y la versi\u00f3n 0.7.31 del SDK de Python, los controles de redacci\u00f3n de salida del SDK de LangSmith (hideOutputs en JS, hide_outputs en Python) no se aplican a los eventos de token de streaming. Cuando una ejecuci\u00f3n de LLM produce salida de streaming, cada fragmento se registra como un evento new_token que contiene el valor de token sin procesar. Estos eventos eluden completamente la canalizaci\u00f3n de redacci\u00f3n - prepareRunCreateOrUpdateInputs (JS) y _hide_run_outputs (Python) solo procesan los campos de entrada y salida en una ejecuci\u00f3n, nunca el array de eventos. Como resultado, las aplicaciones que dependen de la redacci\u00f3n de salida para evitar que la salida sensible de LLM se almacene en LangSmith seguir\u00e1n filtrando el contenido completo de streaming a trav\u00e9s de los eventos de ejecuci\u00f3n. La versi\u00f3n 0.5.19 del SDK de JavaScript y la versi\u00f3n 0.7.31 del SDK de Python solucionan el problema."}], "id": "CVE-2026-41182", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41182", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T14:22:03.787610Z", "version": "2.0.3"}}]}, "published": "2026-04-23T02:16:16.123", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-rr7j-v2q5-chgv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-359"}, {"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.5.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.7.31)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "langsmith-sdk", "source": "cna", "vendor": "langchain-ai"}, "product": "langsmith-sdk", "vendor": "langchain-ai"}], "analysis": {"en": {"generated_at": "2026-04-28T20:36:01.435530+00:00", "value": {"mitigation_remediation": ["Upgrade the JavaScript SDK to version\u00a00.5.19 or later", "Upgrade the Python SDK to version\u00a00.7.31 or later", "Configure the SDK\u2019s hideOutputs/hide_outputs option to ensure all streaming output passes through the redaction pipeline even when token events are emitted", "Disable or sanitize logging of raw token events to prevent accidental exposure (addressing CWE\u2011532)", "Verify that no hard\u2011coded secrets or credentials are present in the token streams before sending them to the model, and remove or mask them if they are found (addressing CWE\u2011359)"], "summary": {"action": "Patch SDK", "impact": "Information disclosure via unredacted streamed tokens"}, "threat_synthesis": {"affected_systems": "The affected products are the LangSmith SDK for JavaScript (prior to version 0.5.19) and the LangSmith SDK for Python (prior to version 0.7.31) published by langchain\u2011ai. Applications that rely on the SDK\u2019s output\u2011redaction controls and use streaming output will be impacted unless they are updated to the specified patched releases.", "description_and_impact": "The vulnerability causes the LangSmith SDK\u2019s output redaction settings\u2014hideOutputs in JavaScript and hide_outputs in Python\u2014to be ignored for streaming token events. When an LLM run produces output in a streaming fashion, each chunk is emitted as a new_token event that carries the raw token value. These events are recorded on the run without passing through the SDK\u2019s redaction pipeline, so any sensitive text generated by the model is stored in LangSmith as part of the run events.", "risk_and_exploitability": "The CVSS base score is 5.3, indicating a moderate risk, but the EPSS score of < 1% shows that the likelihood of exploitation is very low at present, and the vulnerability is not listed in CISA\u2019s KEV catalog. The most likely attack vector is an application or service that consumes the SDK to run a language model and is configured to capture streaming outputs. An attacker could feed the application a prompt that triggers streaming of sensitive data, thereby causing the raw token events to be logged in LangSmith without redaction. The impact is purely information disclosure; there is no privilege escalation or denial of service."}}}}, "created": "2026-04-28T00:00:17.459488+00:00", "updated": "2026-04-28T20:45:16.589724+00:00", "vendors": ["langchain-ai", "langchain-ai$PRODUCT$langsmith-sdk"]}