# CVE-2026-45134: LangChain LangSmith SDK untrusted deserialization in prompt pull methods

Source: https://junglewise.ai/threats/cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45134 · Severity: high · CVSS 7.1 · Published 2026-05-27

LangSmith SDK is a Python and JavaScript library used to fetch and manage AI prompts from LangSmith Hub. When pulling prompts published by other users, the SDK deserializes untrusted prompt manifests without warning, allowing an attacker to inject malicious code or redirect AI model traffic to attacker-controlled servers. This can lead to credential theft, prompt injection attacks, and service disruption for applications that use public prompts.

Technologies: [LangChain LangSmith SDK](https://junglewise.ai/threats/technologies/langsmith-sdk), [langsmith (npm)](https://junglewise.ai/threats/technologies/langsmith), [langchain (PyPI)](https://junglewise.ai/threats/technologies/langchain), [langsmith (PyPI)](https://junglewise.ai/threats/technologies/pypi-langsmith). Vendors: [LangChain](https://junglewise.ai/threats/vendors/langchain), [npm](https://junglewise.ai/threats/vendors/npm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45134 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45134 being exploited in the wild.

**How severe is CVE-2026-45134?** High severity, with a CVSS score of 7.1, published 27 May 2026.

**Which products and versions are affected?** langsmith (npm) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0; langchain (PyPI) < 0.3.30, ECOSYSTEM:introduced=0,fixed=0.3.30; langchain-classic (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7; langsmith (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.0.

**Is there a fix for CVE-2026-45134?** Yes. langsmith (npm): upgrade to 0.6.0 or later; langchain (PyPI): upgrade to 0.3.30 or later; langchain-classic (PyPI): upgrade to 1.0.7 or later; langsmith (PyPI): upgrade to 0.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45134 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45134?** Check whether you run LangChain LangSmith SDK, langsmith (npm), langchain (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langsmith (npm): upgrade to 0.6.0 or later

  ```sh
  npm install langsmith@0.6.0
  ```

- langchain (PyPI): upgrade to 0.3.30 or later

  ```sh
  pip install "langchain>=0.3.30"
  ```

- langchain-classic (PyPI): upgrade to 1.0.7 or later

  ```sh
  pip install "langchain-classic>=1.0.7"
  ```

- langsmith (PyPI): upgrade to 0.8.0 or later

  ```sh
  pip install "langsmith>=0.8.0"
  ```


## Technical details

The vulnerability exists in the pull_prompt / pull_prompt_commit (Python) and pullPrompt / pullPromptCommit (JS/TS) methods, which fetch and deserialize prompt manifests from LangSmith Hub. Prior to the fix, the SDK did not distinguish between prompts pulled from the caller's own organization (trusted) and prompts pulled by owner/name from external accounts (untrusted). Attackers can exploit this by crafting prompt manifests containing serialized LangChain Runnable or PromptTemplate objects with malicious constructor kwargs. When deserialized, these objects may configure an LLM client with an attacker-controlled base_url or proxy, redirecting traffic and potentially disclosing provider credentials, system prompts, and retrieved context. Additionally, if include_model=True is passed, the deserialization allowlist expands to partner integration classes, further increasing attack surface. The fix requires callers to explicitly pass dangerously_pull_public_prompt=True (Python) or dangerouslyPullPublicPrompt: true (JS/TS) to acknowledge the trust boundary.

## Affected products

- LangChain AI LangSmith SDK Python < 0.8.0, JS/TS < 0.6.0
- LangChain AI langsmith < 0.8.0 (pip), < 0.6.0 (npm)
- LangChain AI langchain < 0.3.30
- LangChain AI langchain-classic < 1.0.7

## Identifiers

- CVE-2026-45134
- GHSA-3644-q5cj-c5c7
- PYSEC-2026-2555
- PYSEC-2026-2560
- PYSEC-2026-2582

## Timeline

- 2026-05-13: disclosed: GHSA-3644-q5cj-c5c7 published
- 2026-05-13: patched: LangSmith SDK Python >= 0.8.0 and JS/TS >= 0.6.0 released with dangerously_pull_public_prompt flag

## References

- [https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-3644-q5cj-c5c7](https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-3644-q5cj-c5c7)
- [https://github.com/langchain-ai/langsmith-sdk](https://github.com/langchain-ai/langsmith-sdk)

## Related threats

- [PYSEC-2026-2584 - LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection](https://junglewise.ai/threats/cve-2026-25528-langchain-langsmith-sdk-server-side-request-forgery-via-tracing)
- [PYSEC-2026-2561 - Denial of service in langchain-community](https://junglewise.ai/threats/cve-2024-2965-langchain-sitemaploader-denial-of-service-via-infinite-recursion)
- [PYSEC-2026-1507 - Langchain SQL Injection vulnerability](https://junglewise.ai/threats/cve-2024-8309-langchain-sql-injection-vulnerability)
- [PYSEC-2026-1514 - LangChain pickle deserialization of untrusted data](https://junglewise.ai/threats/cve-2024-5998-langchain-pickle-deserialization-of-untrusted-data)
- [PYSEC-2026-1510 - langchain vulnerable to path traversal](https://junglewise.ai/threats/cve-2024-3571-langchain-vulnerable-to-path-traversal)