GHSA-rr7j-v2q5-chgv
Medium · 5.3CVSS
5.3
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
LangSmith SDK: Streaming token events bypass output redaction
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | langsmith | 0 | 0.7.31 |
| npm | langsmith | 0 | 0.5.19 |
Related vulnerabilities
- CVE-2026-41182 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Same vulnerability
- CVE-2026-45134 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-3644-q5cj-c5c7 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary… Also affects langsmith
- CVE-2026-25528 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-v34v-rq6j-cj6p LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection Also affects langsmith
- GHSA-fw9q-39r9-c252 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__`… Also affects langsmith
- CVE-2026-40190 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200