CVE-2026-45134: 
Python vulnerability analysis and mitigation

CVE-2026-45134 is a deserialization of untrusted data vulnerability in the LangSmith SDK that allows an attacker who publishes a malicious public prompt to LangSmith Hub to affect applications that pull that prompt without validating its contents. It affects LangSmith SDK Python versions prior to 0.8.0, JS/TS versions prior to 0.6.0, LangChain (pip) prior to 0.3.30, and LangChain-Classic prior to 1.0.7. The vulnerability was first reported by @Moaaz-0x, published to the GitHub Advisory Database on May 13, 2026, and to the NVD on May 27, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, LangSmith Advisory).

The root cause is CWE-502 (Deserialization of Untrusted Data): the SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python; pullPrompt / pullPromptCommit in JS/TS) fetch prompt manifests from LangSmith Hub and deserialize them without distinguishing between prompts from the caller's own organization and those published by external, potentially untrusted parties. Prompt manifests can contain serialized LangChain Runnable or PromptTemplate objects with attacker-controlled constructor arguments, custom base_url or proxy settings for LLM clients, and — if secrets_from_env=True is enabled — references that read environment variables at deserialization time. Exploitation requires that the application calls a pull method with a public owner/name identifier, the prompt was published or modified by an untrusted account, and the application uses the pulled prompt without independent validation. Risk is further elevated when include_model=True is passed, expanding the deserialization allowlist to partner integration classes (GitHub Advisory, LangSmith Advisory).

Successful exploitation can result in server-side request forgery (SSRF), where LLM traffic is redirected to an attacker-controlled endpoint, potentially exposing prompt contents, system prompts, retrieved context, model parameters, and provider API credentials. Attackers can also manipulate application behavior through injected system messages, prompt templates, or model parameters embedded in the malicious manifest. If secrets_from_env=True is in use, environment variables — including API keys and secrets — may be read and exfiltrated at deserialization time. The confidentiality impact is rated High, with a Low integrity impact and no direct availability impact (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.036% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction in the sense that a developer must pull a malicious public prompt, but no privileges are required on the attacker's side to publish a prompt to LangSmith Hub (GitHub Advisory).

1. Publish a malicious prompt: The attacker creates a LangSmith Hub account and publishes a prompt manifest under their owner/name namespace. The manifest is crafted to include a serialized LangChain object (e.g., an LLM client) with an attacker-controlled base_url or proxy endpoint, or embeds attacker-controlled system messages and constructor kwargs.
2. Induce the target application to pull the prompt: The attacker distributes or advertises the malicious prompt identifier (e.g., attacker-org/malicious-prompt) to developers or applications that use pull_prompt('attacker-org/malicious-prompt') in Python or pullPrompt('attacker-org/malicious-prompt') in JS/TS.
3. Trigger deserialization: When the vulnerable SDK fetches the manifest, it deserializes the embedded LangChain objects and instantiates them with the attacker-supplied constructor arguments, without enforcing a trust boundary between public and private prompts.
4. Achieve SSRF or credential theft: If the manifest configures an LLM client with an attacker-controlled base_url, all subsequent LLM API calls from the application are redirected to the attacker's server, which may receive prompt contents, system prompts, API keys, and other secrets in request headers or bodies.
5. Optional — environment variable exfiltration: If the target application passes secrets_from_env=True, the attacker can include secret references in the manifest that cause the SDK to read and transmit environment variables (e.g., OPENAI_API_KEY) to the attacker-controlled endpoint during deserialization (GitHub Advisory, LangSmith Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the application server to unknown or external endpoints during LLM inference (i.e., requests not directed to the configured LLM provider such as OpenAI, Anthropic, etc.); DNS lookups for attacker-controlled domains initiated by the LangChain/LangSmith process.
• Logs: Application logs showing LLM API calls to unexpected base_url values or proxy addresses; LangSmith SDK logs referencing deserialization of prompts from external owner/name identifiers not belonging to the organization.
• Environment: Evidence of secrets_from_env=True being used in conjunction with public prompt pulls; unexpected reads of environment variables (e.g., OPENAI_API_KEY, LANGSMITH_API_KEY) at prompt deserialization time.
• Process Behavior: LangChain objects instantiated with constructor arguments not matching the application's own configuration (e.g., base_url pointing to an external host); prompt manifests containing serialized Runnable or PromptTemplate objects with unfamiliar kwargs (GitHub Advisory).

Upgrade to LangSmith SDK Python >= 0.8.0 or JS/TS >= 0.6.0, which blocks pulling public prompts by owner/name by default. Also upgrade LangChain (pip) to >= 0.3.30 and LangChain-Classic to >= 1.0.7. In patched versions, callers must explicitly pass dangerously_pull_public_prompt=True (Python) or dangerouslyPullPublicPrompt: true (JS/TS) to pull public prompts, and should only do so after reviewing and trusting the prompt contents. As additional hardening, avoid using include_model=True or secrets_from_env=True when pulling prompts from outside your organization, and treat all prompt manifests as executable configuration subject to the same review as application code (GitHub Advisory, LangSmith Advisory).

The vulnerability was credited to security researchers @Moaaz-0x and @berardinellidaniele, who reported it to the LangChain team. The advisory was published by LangChain maintainer @eyurtsev on May 7, 2026. No significant broader media coverage or notable social media commentary beyond the GitHub advisory has been identified at this time (LangSmith Advisory).