GHSA-3644-q5cj-c5c7: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
- Identifiers
- CVE-2026-45134GHSA-3644-q5cj-c5c7
- Published
- Record updated
- Affected
- langchain < 0.3.30, fixed in 0.3.30, released May 7, 2026, 6 days before disclosure
- langchain-classic < 1.0.7, fixed in 1.0.7, released May 7, 2026, 6 days before disclosure
- langsmith < 0.6.0, fixed in 0.6.0, released April 30, 2026, 13 days before disclosure
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
The LangSmith SDK's prompt pull methods (`pull_prompt` / `pull_prompt_commit` in Python, `pullPrompt` / `pullPromptCommit` in JS/TS) deserialize prompt manifests from the LangSmith Hub without distinguishing public prompts pulled by `owner/name` from prompts within the caller's own organization. A malicious or compromised publisher can supply manifests that instantiate LangChain objects with attacker-chosen constructor arguments, such as an LLM `base_url`, which can redirect traffic and expose prompts, credentials and other secrets, or alter model behavior.
Mitigation
The LangSmith SDK now blocks pulling public prompts by `owner/name` by default; callers must pass `dangerously_pull_public_prompt=True` (Python) or `dangerouslyPullPublicPrompt: true` (JS/TS) after reviewing the prompt contents. Upgrade to LangSmith SDK Python >= 0.8.0 or JS/TS >= 0.6.0.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langsmithnpmNo LLM dependency detected · 8 tracked dependents
- langchainPyPILLM dependency since 2022-10-25 · 31 tracked dependents
- langchain-classicPyPILLM dependency since 2025-10-07 · 6 tracked dependents
- langsmithPyPILLM dependency since 2025-03-14 · 10 tracked dependents
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database