CVE-2026-41182

What it actually does

The LangSmith JavaScript SDK before 0.5.19 and Python SDK before 0.7.31 fail to apply configured output-redaction controls to streaming LLM token events. Although run-level outputs are processed by the redaction logic, streamed chunks are stored separately as new_token events containing raw token values. Any sensitive content emitted during streaming—such as personal data, credentials, proprietary text, prompts, generated answers, or regulated data—may therefore be persisted in LangSmith run event records despite hideOutputs or hide_outputs being enabled.

Why it matters to the business

Organizations using LangSmith SDK streaming with output redaction may have unintentionally stored sensitive model output in observability telemetry. This can create privacy, compliance, contractual, and data-retention exposure, especially where LLM responses may contain customer data, secrets, regulated records, or confidential business information. The CVSS and EPSS indicate moderate severity and low observed exploitation likelihood, and it is not listed in CISA KEV, but the risk is primarily data exposure through normal application behavior rather than traditional remote compromise.

How an attack unfolds

This issue is most likely triggered during ordinary application operation rather than by a classic exploit payload. An application enables LangSmith output redaction and streams LLM responses through an affected JavaScript or Python SDK. The SDK creates run records and event records for streamed tokens. The run output field is redacted, but each streaming chunk is also recorded as a new_token event. Because the event array bypasses the redaction pipeline, the raw token value is persisted. An attacker, insider, compromised account, or over-privileged integration with access to LangSmith traces or exported telemetry could then retrieve sensitive streamed content that operators believed had been redacted.

How to fix it

Upgrade all affected LangSmith Client SDK usage to fixed versions: JavaScript SDK 0.5.19 or later and Python SDK 0.7.31 or later. Regenerate lockfiles and redeploy services so the fixed SDK versions are actually loaded at runtime. Where immediate upgrade is not possible, disable streaming telemetry capture, avoid sending sensitive LLM outputs to LangSmith, restrict trace/event access to least privilege, shorten telemetry retention, and consider disabling LangSmith tracing for workflows that may emit sensitive information. Review and purge or redact historical run event data containing new_token values generated by affected SDK versions where retention and compliance requirements allow.

How to confirm the fix worked

Confirm dependency versions in package manifests, lockfiles, containers, build artifacts, and deployed runtime environments. For JavaScript, verify the installed LangSmith SDK is 0.5.19 or later; for Python, verify it is 0.7.31 or later. Run a controlled streaming test with output redaction enabled and a synthetic sensitive marker in the generated response, then inspect LangSmith run events to confirm the marker does not appear in new_token event payloads. Also verify that historical traces created before the upgrade are reviewed separately, because upgrading does not automatically remove previously stored sensitive event data.

Typical attack path

1. Identify an application or service using LangSmith tracing with streaming LLM output enabled.
2. Confirm the application uses an affected LangSmith JavaScript SDK version before 0.5.19 or Python SDK version before 0.7.31.
3. Cause or wait for an LLM run to produce sensitive streamed output while hideOutputs or hide_outputs is enabled.
4. Access LangSmith run event data through the UI, API, exports, logs, or a compromised/over-privileged account.
5. Inspect new_token event records and reconstruct the streamed response from raw token values.

How to detect it

To determine whether exposure already occurred, review LangSmith trace/run event data, LangSmith API access logs, application logs, and any SIEM or data lake copies of observability telemetry. Focus on runs created by services using LangSmith JavaScript SDK versions before 0.5.19 or Python SDK versions before 0.7.31 with streaming enabled and output redaction configured. Search event payloads for new_token records containing raw token values, especially secrets, personal data, regulated identifiers, or internal confidential terms. Review access logs for users, API keys, service accounts, or integrations that viewed, exported, or bulk-read run events after sensitive traces were created. Pay special attention to unusual query volume, exports, downloads, access from unfamiliar IP addresses, access outside normal business hours, or trace access by accounts that do not normally operate observability workflows. Because this flaw does not require a distinctive exploit request, detection depends on identifying sensitive data persisted in token events and determining who accessed or exported those records.

• "event":"new_token"
• "new_token"
• "token"
• "hideOutputs"
• "hide_outputs"
• "prepareRunCreateOrUpdateInputs"
• "_hide_run_outputs"
• "langsmith"
• "@langchain/langsmith"
• "langsmith<0.7.31"
• "langsmith-js<0.5.19"
• "new_token" AND "hide_outputs"
• "new_token" AND "hideOutputs"

What your security team should do

• Inventory applications using LangSmith SDKs and prioritize those that enable streaming LLM responses and output redaction.
• Upgrade JavaScript LangSmith SDK deployments to 0.5.19 or later and Python LangSmith SDK deployments to 0.7.31 or later.
• Search historical LangSmith run events for sensitive data in new_token records produced by affected SDK versions.
• Restrict access to LangSmith traces, run events, exports, and API tokens to users and services with a documented business need.
• Review retention, deletion, and export policies for LangSmith telemetry that may contain sensitive LLM output.
• Add regression tests that verify redaction applies to streamed token events, not only final run output fields.
• Monitor for unusual access to LangSmith trace data, including bulk exports, high-volume API reads, and access by unexpected users or integrations.