MEDIUM 5.3 npm PyPI
GHSA-rr7j-v2q5-chgv · CVE-2026-41182 LangSmith SDK: Streaming token events bypass output redaction
Modified: 5/6/2026
package
npm / langsmith
pkg:npm/langsmith
MEDIUM 5.8 PyPI npm
GHSA-v34v-rq6j-cj6p · CVE-2026-25528 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Modified: 2/22/2026
HIGH 7.1 PyPI npm
GHSA-3644-q5cj-c5c7 · CVE-2026-45134 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Modified: 6/9/2026
MEDIUM 5.6 npm
GHSA-fw9q-39r9-c252 · CVE-2026-40190 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Modified: 4/16/2026