TI-2026-32967 Aliases CVE-2026-45134 GHSA-3644-q5cj-c5c7

LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

LOW 31CWE-502Published 2026-05-27 · Updated 2026-06-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · Low · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00199 9th percentileScored 2026-11-07

Fix Partial langsmith-sdk (langchain-ai): 0.8.0, 0.6.0langsmith (PyPI): 0.8.0+3 more productsRed Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langchain-ai	langsmith-sdk	before 0.8.0; before 0.6.0	0.8.0, 0.6.0	Patch available	CNA
—	langsmith (PyPI)	before 0.8.0	0.8.0	Patch available	GHSA-3644-q5cj-c5c7
—	langsmith (npm)	before 0.6.0	0.6.0	Patch available	GHSA-3644-q5cj-c5c7
—	langchain-classic (PyPI)	before 1.0.7	1.0.7	Patch available	GHSA-3644-q5cj-c5c7
—	langchain (PyPI)	before 0.3.30	0.3.30	Patch available	GHSA-3644-q5cj-c5c7

langsmith-sdk Vendorlangchain-ai Affected before 0.8.0; before 0.6.0 Fixed in 0.8.0, 0.6.0 Patch available CNA
langsmith (PyPI) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-3644-q5cj-c5c7
langsmith (npm) Vendor— Affected before 0.6.0 Fixed in 0.6.0 Patch available GHSA-3644-q5cj-c5c7
langchain-classic (PyPI) Vendor— Affected before 1.0.7 Fixed in 1.0.7 Patch available GHSA-3644-q5cj-c5c7
langchain (PyPI) Vendor— Affected before 0.3.30 Fixed in 0.3.30 Patch available GHSA-3644-q5cj-c5c7

Remediation

Fix · CNA langsmith-sdk (langchain-ai) Fixed in 0.8.0, 0.6.0
Fix · GHSA-3644-q5cj-c5c7 langsmith (PyPI) Fixed in 0.8.0 Advisory →
Fix · GHSA-3644-q5cj-c5c7 langsmith (npm) Fixed in 0.6.0 Advisory →
Fix · GHSA-3644-q5cj-c5c7 langchain-classic (PyPI) Fixed in 1.0.7 Advisory →
Fix · GHSA-3644-q5cj-c5c7 langchain (PyPI) Fixed in 0.3.30 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Lightspeed	Affected	No fix yet
Red Hat Ansible Automation Platform 2	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet

Not affected: 2 products

Red Hat Ansible Automation Platform 2
Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2026-45134
2026-10-03 Alias added: GHSA-3644-q5cj-c5c7

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45134

Other 2

TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8

See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences