The vulnerability causes the LangSmith SDK’s output redaction settings—hideOutputs in JavaScript and hide_outputs in Python—to be ignored for streaming token events. When an LLM run produces output in a streaming fashion, each chunk is emitted as a new_token event that carries the raw token value. These events are recorded on the run without passing through the SDK’s redaction pipeline, so any sensitive text generated by the model is stored in LangSmith as part of the run events.

The affected products are the LangSmith SDK for JavaScript (prior to version 0.5.19) and the LangSmith SDK for Python (prior to version 0.7.31) published by langchain‑ai. Applications that rely on the SDK’s output‑redaction controls and use streaming output will be impacted unless they are updated to the specified patched releases.

The CVSS base score is 5.3, indicating a moderate risk, but the EPSS score of < 1% shows that the likelihood of exploitation is very low at present, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is an application or service that consumes the SDK to run a language model and is configured to capture streaming outputs. An attacker could feed the application a prompt that triggers streaming of sensitive data, thereby causing the raw token events to be logged in LangSmith without redaction. The impact is purely information disclosure; there is no privilege escalation or denial of service.