PT-2026-59238

Summary The LangSmith SDK's output redaction controls hideOutputs in JS, hide outputs in Python do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new token event containing the raw token value. These events bypass the redaction pipeline...

Server-side Request Forgery (SSRF)

Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the improper validation of apiurl and apikey fields in baggage headers in RunTree.fromheaders and...