Threats affecting pkg:npm/langchain-ai/langsmith-sdk

CVE-2026-41182 is a vulnerability in the langchain-ai langsmith-sdk JavaScript and Python SDKs prior to versions 0.5.19 and 0.7.31 respectively. The issue arises because output redaction controls do not apply to streaming token events, allowing raw token values from streaming LLM outputs to be recorded and stored without redaction. This results in unintended exposure of sensitive information through run event data. The vulnerability has a CVSS score of 5.3, indicating medium severity. Fixed versions are available that address this issue by properly applying redaction to streaming events.