Deserialization Vulnerability in LangSmith Client SDKs for Python and JavaScript/TypeScript
CVE-2026-45134

7.1HIGH

Key Information:

Vendor

Langchain-ai

Status
Langsmith-sdk
Vendor
CVE Published:
27 May 2026

What is CVE-2026-45134?

The LangSmith Client SDKs, utilized for interacting with the LangSmith platform, have a deserialization vulnerability in versions prior to Python 0.8.0 and JS/TS 0.6.0. This issue arises from the SDK's prompt pull methods, which fail to differentiate between prompts owned by external parties and those belonging to the user's organization. As a result, when fetching public prompts, the manifest data pulled may be controlled by malicious actors. This can potentially lead to altered runtime behavior of applications utilizing these SDKs. To mitigate this risk, users are advised to update to the latest versions provided by LangSmith.

Affected Version(s)

langsmith-sdk < 0.8.0 < 0.8.0

langsmith-sdk < 0.6.0 < 0.6.0

References

https://github.com/langchain-ai/langsmith-sdk/security/ad...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.