CVE-2026-45134: LangChain LangSmith SDK untrusted deserialization in prompt pull methods

CVE-2026-45134 · Severity: high · CVSS 7.1 · Published 2026-05-27

LangSmith SDK is a Python and JavaScript library used to fetch and manage AI prompts from LangSmith Hub. When pulling prompts published by other users, the SDK deserializes untrusted prompt manifests without warning, allowing an attacker to inject malicious code or redirect AI model traffic to attacker-controlled servers. This can lead to credential theft, prompt injection attacks, and service disruption for applications that use public prompts.

Technologies: LangChain LangSmith SDK, langsmith (npm), langchain (PyPI), langsmith (PyPI). Vendors: LangChain, npm, PyPI.

Quick answers

Is CVE-2026-45134 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45134 being exploited in the wild.
How severe is CVE-2026-45134?
High severity, with a CVSS score of 7.1, published 27 May 2026.
Which products and versions are affected?
langsmith (npm) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0; langchain (PyPI) < 0.3.30, ECOSYSTEM:introduced=0,fixed=0.3.30; langchain-classic (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7; langsmith (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.0.
Is there a fix for CVE-2026-45134?
Yes. langsmith (npm): upgrade to 0.6.0 or later; langchain (PyPI): upgrade to 0.3.30 or later; langchain-classic (PyPI): upgrade to 1.0.7 or later; langsmith (PyPI): upgrade to 0.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45134 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45134?
Check whether you run LangChain LangSmith SDK, langsmith (npm), langchain (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langsmith (npm): upgrade to 0.6.0 or later
    npm install langsmith@0.6.0
  • langchain (PyPI): upgrade to 0.3.30 or later
    pip install "langchain>=0.3.30"
  • langchain-classic (PyPI): upgrade to 1.0.7 or later
    pip install "langchain-classic>=1.0.7"
  • langsmith (PyPI): upgrade to 0.8.0 or later
    pip install "langsmith>=0.8.0"

Technical details

The vulnerability exists in the pull_prompt / pull_prompt_commit (Python) and pullPrompt / pullPromptCommit (JS/TS) methods, which fetch and deserialize prompt manifests from LangSmith Hub. Prior to the fix, the SDK did not distinguish between prompts pulled from the caller's own organization (trusted) and prompts pulled by owner/name from external accounts (untrusted). Attackers can exploit this by crafting prompt manifests containing serialized LangChain Runnable or PromptTemplate objects with malicious constructor kwargs. When deserialized, these objects may configure an LLM client with an attacker-controlled base_url or proxy, redirecting traffic and potentially disclosing provider credentials, system prompts, and retrieved context. Additionally, if include_model=True is passed, the deserialization allowlist expands to partner integration classes, further increasing attack surface. The fix requires callers to explicitly pass dangerously_pull_public_prompt=True (Python) or dangerouslyPullPublicPrompt: true (JS/TS) to acknowledge the trust boundary.

Affected products

  • LangChain AI LangSmith SDK Python < 0.8.0, JS/TS < 0.6.0
  • LangChain AI langsmith < 0.8.0 (pip), < 0.6.0 (npm)
  • LangChain AI langchain < 0.3.30
  • LangChain AI langchain-classic < 1.0.7

Identifiers

  • CVE-2026-45134
  • GHSA-3644-q5cj-c5c7
  • PYSEC-2026-2555
  • PYSEC-2026-2560
  • PYSEC-2026-2582

Timeline

  • 2026-05-13: disclosed: GHSA-3644-q5cj-c5c7 published
  • 2026-05-13: patched: LangSmith SDK Python >= 0.8.0 and JS/TS >= 0.6.0 released with dangerously_pull_public_prompt flag

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.