7.1
High
CVE-2026-45134 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform
Description
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| langsmith-sdk 0.8 | earliest → < 0.8.0 | 0.8.0 |
| langsmith-sdk 0.6 | earliest → < 0.6.0 | 0.6.0 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of langsmith-sdk
The 5 CVEs of langsmith-sdk →
CVE-2026-59152
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform
5.0
Medium
CVE-2026-41182
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform
5.3
Medium
CVE-2026-40190
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform
5.6
Medium
CVE-2026-25528
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform
5.8
Medium