142 matches found
LangSmith Client SDKs 信息泄露漏洞
LangSmith Client SDKs are a developer toolkit open-sourced by LangChain. LangSmith Client SDKs have a vulnerability related to information leakage, which stems from the fact that output editing controls do not apply to streaming token events, potentially leading to sensitive LLM outputs being...
CVE-2026-41182: Exposure of Sensitive Information to an Unauthorized Actor
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When ...
Insertion of Sensitive Information into Log File
Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the Client handling of events. An attacker can bypass redaction controls and...
0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2984 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.5.4)
langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-41182 Source advisory: SNYK:JS-LANGSMITH-16082039...
LangSmith SDK: Streaming token events bypass output redaction
Summary The LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a newtoken event containing the raw token value. These events bypass the redaction pipeline...
0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2984 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.5.4)
langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-41182 Source advisory: GHSA-RR7J-V2Q5-CHGV...
Insertion of Sensitive Information into Log File
Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the Client handling of events. An attacker can bypass redaction controls and...
a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1454 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.7.22)
langsmith PYPI version =0.0.5, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =0.1.0, =0.1.1, =2.1.7, =0.1.1, =0.1.3 and more Source cves: CVE-2026-41182 Source advisory: GHSA-RR7J-V2Q5-CHGV...
0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2984 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.5.4)
langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-41182 Source advisory: OSV:GHSA-RR7J-V2Q5-CHGV...
a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1454 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.7.22)
langsmith PYPI version =0.0.5, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =0.1.0, =0.1.1, =2.1.7, =0.1.1, =0.1.3 and more Source cves: CVE-2026-41182 Source advisory: OSV:GHSA-RR7J-V2Q5-CHGV...
PT-2026-34593
Name of the Vulnerable Software and Affected Versions LangSmith JavaScript SDK versions prior to 0.5.19 LangSmith Python SDK versions prior to 0.7.31 Description Output redaction controls do not apply to streaming token events. When a Large Language Model run produces streaming output, each chunk...
SUSE CVE-2026-40190
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. The baseAssignValue function only guards against the...
CVE-2026-40190
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. The baseAssignValue function only guards against the...
Prototype Pollution
LangSmith is vulnerable to Prototype Pollution. The vulnerability is due to an incomplete prototype pollution fix in its internally vendored lodash set utility, where the baseAssignValue function only guards against the proto key, but fails to prevent traversal via constructor.prototype, and...
Prototype Pollution
Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Prototype Pollution via constructor.prototype in the baseAssignValue function. An attacker can modify the Object.prototype by supplying...
0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2984 more potentially affected by CVE-2026-40190 via langsmith (>=0.0.5, <=0.5.4)
langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-40190 Source advisory: SNYK:JS-LANGSMITH-15969264...
GHSA-FW9Q-39R9-C252 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
GHSA-fw9q-39r9-c252: Prototype Pollution via Incomplete Lodash set Guard in langsmith-sdk Severity: Medium CVSS 5.6 Status: Fixed in 0.5.18 --- Summary The LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. T...
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
GHSA-fw9q-39r9-c252: Prototype Pollution via Incomplete Lodash set Guard in langsmith-sdk Severity: Medium CVSS 5.6 Status: Fixed in 0.5.18 --- Summary The LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. T...
0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2984 more potentially affected by CVE-2026-40190 via langsmith (>=0.0.5, <=0.5.4)
langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-40190 Source advisory: OSV:GHSA-FW9Q-39R9-C252...
