What is the CVSS score of CVE-2026-41182?

CVE-2026-41182 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41182?

Yes, a patch is available for CVE-2026-41182. Update the affected software to the latest version immediately.

LangSmith SDK CVE-2026-41182

EUVD-2026-25152 MEDIUM

Information Exposure (CWE-200)

2026-04-23 GitHub_M

Information Disclosure Python

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 29, 2026 - 20:46 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:07 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 01:15 euvd

EUVD-2026-25152

Analysis Generated

Apr 23, 2026 - 01:15 vuln.today

CVE Published

Apr 23, 2026 - 00:14 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on langsmith (5 direct, 2 indirect)

Ecosystem-wide dependent count for version 0.5.19.

DescriptionGitHub Advisory

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely - prepareRunCreateOrUpdateInputs (JS) and _hide_run_outputs (Python) only process the inputs and outputs fields on a run, never the events array. As a result, applications relying on output redaction to prevent sensitive LLM output from being stored in LangSmith will still leak the full streamed content via run events. Version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK fix the issue.

AnalysisAI

LangSmith Client SDKs in JavaScript (prior to 0.5.19) and Python (prior to 0.7.31) fail to apply output redaction controls to streaming token events, allowing sensitive LLM-generated content to leak into LangSmith platform storage despite hideOutputs/hide_outputs being enabled. Unauthenticated remote attackers can intercept or access unredacted streamed tokens if they gain visibility into run events, bypassing the intended confidentiality controls.

Technical ContextAI

The LangSmith SDKs implement output redaction through prepareRunCreateOrUpdateInputs (JavaScript) and _hide_run_outputs (Python) functions that sanitize the inputs and outputs fields on run objects before transmission to the LangSmith platform. However, when an LLM generates streaming output (common in modern LLM integrations), each token chunk is recorded as a separate new_token event appended to the events array within the run object. The redaction pipeline processes only the top-level inputs and outputs fields and completely bypasses the events array, causing raw token values to persist unredacted. This is fundamentally an information disclosure flaw (CWE-200) where trust boundaries fail - applications assume redaction applies uniformly across all output channels, but the streaming event path operates outside the redaction mechanism. The vulnerability affects the langsmith-sdk package across its Python and JavaScript implementations.

RemediationAI

Vendor-released patch: Upgrade to LangSmith JavaScript SDK version 0.5.19 or later, and Python SDK version 0.7.31 or later. Both versions restore redaction coverage to the events array, ensuring new_token events are processed through the redaction pipeline. Organizations should apply these upgrades immediately if they rely on the hideOutputs (JavaScript) or hide_outputs (Python) feature for compliance or data protection. No workarounds are available short of patching - disabling streaming integrations entirely would preserve redaction guarantees but is not practical for production LLM applications. Interim mitigations include restricting LangSmith workspace access via IAM, encrypting network traffic between SDK and LangSmith platform with TLS, and monitoring LangSmith workspace access logs for unexpected data access. See GitHub security advisory GHSA-rr7j-v2q5-chgv for detailed patch notes.