CVE-2026-45134: LangSmith SDK Use-After-Free Vulnerability

CVE-2026-45134 Overview

CVE-2026-45134 is an insecure deserialization vulnerability in the LangSmith Client SDKs for Python and JavaScript/TypeScript. The SDK's prompt pull methods fetch and deserialize prompt manifests from the LangSmith Hub. These manifests can contain serialized LangChain objects and model configuration that influence runtime behavior. Affected versions did not distinguish between pulling a public prompt controlled by an external party and pulling a prompt within the caller's own organization. An attacker who publishes a malicious public prompt can influence runtime behavior in any application that pulls it. The vulnerability is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Applications pulling public prompts by owner/name identifier deserialize attacker-controlled manifests, allowing influence over LangChain object construction and model configuration at runtime.

Affected Products

LangSmith SDK for Python prior to 0.8.0
LangSmith SDK for JavaScript/TypeScript prior to 0.6.0
Applications calling pull_prompt, pull_prompt_commit, pullPrompt, or pullPromptCommit against public prompts on LangSmith Hub

Discovery Timeline

2026-05-27 - CVE-2026-45134 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45134

Vulnerability Analysis

The LangSmith Client SDKs expose prompt pull methods that retrieve manifests from the LangSmith Hub. In Python the methods are pull_prompt and pull_prompt_commit. In JavaScript/TypeScript they are pullPrompt and pullPromptCommit. These manifests are deserialized into LangChain objects and may carry model configuration that alters runtime behavior of the calling application.

When a caller specifies a prompt using an owner/name identifier, the SDK may retrieve a public prompt whose contents are controlled by an external publisher. Affected SDK versions did not differentiate between externally-owned public prompts and prompts owned by the caller's organization. As a result, untrusted manifest content was deserialized with the same trust level as internal content.

Root Cause

The root cause is unsafe deserialization of untrusted data combined with a missing trust boundary. The SDKs treated all prompt manifests as equally trusted regardless of ownership. External publishers on LangSmith Hub could supply manifests that, when deserialized client-side, instantiate LangChain objects or apply model configuration chosen by the publisher.

Attack Vector

Exploitation requires a victim application to call a prompt pull method with an owner/name identifier referencing an attacker-controlled public prompt. The attacker publishes a crafted prompt manifest to LangSmith Hub. When the victim pulls and deserializes it, attacker-supplied serialized LangChain objects and model configuration are instantiated in the victim's process. The vector is network-based and requires user interaction in the form of pulling the attacker-published prompt. Confidentiality impact is high while integrity impact is limited and availability is unaffected.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-3644-q5cj-c5c7 for vendor details.

Detection Methods for CVE-2026-45134

Indicators of Compromise

Outbound calls from application hosts to LangSmith Hub endpoints referencing third-party owner/name prompt identifiers not associated with your organization
Unexpected LangChain object types or model configuration loaded after a prompt pull operation
Process telemetry showing Python or Node.js workers instantiating classes immediately after a prompt manifest fetch

Detection Strategies

Inventory all code paths invoking pull_prompt, pull_prompt_commit, pullPrompt, or pullPromptCommit and identify those passing external owner/name identifiers
Audit dependency manifests (requirements.txt, package.json, lockfiles) for langsmith Python versions below 0.8.0 and JS/TS versions below 0.6.0
Log and review the full identifier used in every prompt pull call to flag external owners

Monitoring Recommendations

Capture network telemetry between application hosts and smith.langchain.com and correlate with process execution events
Alert on new or unexpected child processes, module imports, or model configuration changes following prompt pull operations
Monitor for changes to prompts referenced by external owner/name identifiers that your applications consume

How to Mitigate CVE-2026-45134

Immediate Actions Required

Upgrade the LangSmith Python SDK to 0.8.0 or later and the JavaScript/TypeScript SDK to 0.6.0 or later
Review application code for prompt pull calls referencing external owner/name identifiers and validate whether each external prompt is required
Pin specific commit hashes when pulling third-party prompts to prevent silent manifest changes

Patch Information

The vulnerability is fixed in LangSmith SDK Python 0.8.0 and LangSmith SDK JS/TS 0.6.0. The fixed releases distinguish between pulling a prompt owned by the caller's organization and pulling an externally-controlled public prompt. Refer to the GitHub Security Advisory GHSA-3644-q5cj-c5c7 for full remediation details.

Workarounds

Restrict prompt pulls to identifiers owned by your own organization until the SDK is upgraded
Vendor required public prompts internally and load them from a controlled, reviewed source instead of pulling at runtime
Run applications that must pull external prompts in isolated, least-privilege execution environments with egress filtering

bash

# Configuration example: upgrade to fixed SDK versions
pip install --upgrade 'langsmith>=0.8.0'
npm install langsmith@^0.6.0