High, CVSS 7.1PyPIAmendedPublished
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
CVE-2026-45134 · GHSA-3644-q5cj-c5c7
- Affected
- PyPI langchain-classic < 1.0.7
- Fixed in
- 1.0.7· Vendor fix available
- Issue
- The LangSmith SDK's prompt pull methods (pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. Prompt manifests can intentionally configure a model with a custom base URL, default headers, model name, or other constructor arguments. These are supported features, but they also mean the prompt contents should be treated as executable configuration rather than plain text. A prompt can also include serialized LangChain Runnable or PromptTemplate objects with attacker-controlled constructor kwargs, or secret references that, if secretsfromenv is enabled,…
Recommended action: Upgrade to 1.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.