Vulnerability · Published May 27, 2026 · Assigned by GitHub_M
CVE-2026-45134LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
High 7.1
In plain English
A high-severity unsafe deserialization in langsmith-sdk from langchain-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | langchain | 0.3.30 | GHSA-3644-q5cj-c5c7 |
| PyPI | langchain | 0.3.30 | PYSEC-2026-2555 |
| PyPI | langchain-classic | 1.0.7 | GHSA-3644-q5cj-c5c7 |
| PyPI | langchain-classic | 1.0.7 | PYSEC-2026-2560 |
| PyPI | langsmith | 0.8.0 | GHSA-3644-q5cj-c5c7 |
| PyPI | langsmith | 0.8.0 | PYSEC-2026-2582 |
| npm | langsmith | 0.6.0 | GHSA-3644-q5cj-c5c7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| langchain-ai | langsmith-sdk | < 0.8.0< 0.6.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N