LangSmith SDK EUVD-2026-25152

Output redaction controls must be explicitly enabled (hideOutputs in JavaScript, hide_outputs in Python) for the vulnerability to manifest as a security failure. The application must use streaming LLM integrations (e.g., streaming token callbacks, token-by-token iteration) that generate new_token events, as non-streaming LLM calls do not populate the events array and thus are unaffected. Exploitation further requires the attacker to have access to run event data within the LangSmith workspace (authenticated access, workspace membership) or ability to intercept unencrypted or improperly validated API traffic between the SDK and LangSmith platform. Notably, applications that do not use the output redaction feature, do not use streaming, or are already storing sensitive data outside LangSmith (i.e., using LangSmith only for non-sensitive operational logging) are not vulnerable. The vulnerability does not affect confidentiality of inputs, only outputs/token streams, and it does not cause data loss or unauthorized modification.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network-accessible confidentiality impact with low attack complexity and no authentication barrier, yet the real-world risk is contextual. Exploitation requires that: (1) an application explicitly enables output redaction because it handles sensitive data (e.g., PII, secrets, medical records), (2) the application uses streaming LLM calls, and (3) an attacker can access the LangSmith workspace or intercepted API traffic. The low CVSS score reflects limited scope (confidentiality only, no integrity or availability impact) and the requirement that the attacker must already have some visibility into run events-this is not a vulnerability that exposes data to arbitrary internet actors without authentication to LangSmith itself. However, for organizations using LangSmith as a secure logging backend for sensitive workloads, this represents a critical logic bypass: the redaction feature they depend on silently fails for streaming output. EPSS score not provided, but exploitation probability is moderate to high within affected deployments since attackers need only access to the LangSmith platform (via compromised credentials, insider threat, or shared workspace) or network interception of SDK-to-platform traffic. No CISA KEV status provided; patch is available, indicating this is a vendor-confirmed logic defect rather than an exploited zero-day. Organizations that do not use output redaction or do not use streaming integrations are unaffected.

An attacker with legitimate or compromised access to a LangSmith workspace (or positioned to intercept SDK-to-platform HTTPS traffic via network compromise) observes that an organization has enabled output redaction on an application handling customer PII. The attacker streams a prompt through the vulnerable LangSmith SDK that causes an LLM to output customer email addresses and phone numbers. Although the application's redaction rules would filter this from the outputs field, the raw tokens appear unredacted in the run's events array as new_token objects. The attacker exports the run data and recovers the complete streamed output, bypassing the intended security control.