Listen to this Post
The vulnerability stems from an oversight in how the LangSmith SDK handles output redaction during streaming LLM responses. The SDK provides `hideOutputs` (JS) and `hide_outputs` (Python) to prevent storing sensitive output data. However, these redaction controls are only applied to the `inputs` and `outputs` fields of a run object. When streaming is enabled, each token chunk is emitted as a `new_token` event and appended to the `events` array. The redaction pipeline (prepareRunCreateOrUpdateInputs in JS and `_hide_run_outputs` in Python) never inspects the `events` array. Consequently, every raw token value is recorded unredacted in the `new_token` events. This leak occurs in both SDKs: in the JS SDK at `traceable.ts:997-1003` and traceable.ts:1044-1050, and in the Python SDK at `run_helpers.py:1924` and run_helpers.py:1996. Applications that rely on output redaction to prevent sensitive LLM output from being stored in LangSmith will still have the full streamed content exposed via run events.
DailyCVE Form
Platform: LangSmith SDK
Version: <=0.7.30/0.5.18
Vulnerability: Information Disclosure
Severity: Medium
Date: 2026-04-16
Prediction: Patch available 2026-04-16
What Undercode Say:
Check installed version (Python) pip show langsmith | grep Version Check installed version (JS/TS) npm list langsmith Update to patched version (Python) pip install --upgrade langsmith>=0.7.31 Update to patched version (JS/TS) npm install [email protected]
Python example demonstrating the issue
from langsmith import Client, traceable
from langsmith.wrappers import wrap_openai
client = Client()
@traceable(hide_outputs=True) Redaction enabled
def stream_llm():
wrapped = wrap_openai(openai_client)
stream = wrapped.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": "Sensitive data: password123"}],
stream=True,
)
for chunk in stream:
Each chunk emits a 'new_token' event with raw token content
print(chunk)
Exploit:
A remote attacker triggers streaming output from an LLM call. Because the redaction pipeline does not filter the `events` array, every `new_token` event containing the raw token value is stored in LangSmith. The attacker can then query the run’s events to retrieve the unredacted sensitive output.
Protection from this CVE
- Update the LangSmith SDK to the patched versions: Python `>=0.7.31` or JS
>=0.5.19. - If updating is not immediately possible, avoid using streaming for sensitive data or manually sanitize the `events` array before persisting runs.
Impact:
Successful exploitation leads to information disclosure, exposing sensitive data such as passwords, API keys, or confidential content that the LLM processes, to any party with access to the LangSmith run logs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
