GHSA-3644-q5cj-c5c7
High · 7.1CVSS
7.1
EPSS
—
Published
May 13, 2026
CISA due date
—
The record
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | langchain | 0 | 0.3.30 |
| PyPI | langchain-classic | 0 | 1.0.7 |
| PyPI | langsmith | 0 | 0.8.0 |
| npm | langsmith | 0 | 0.6.0 |
Related vulnerabilities
- CVE-2026-45134 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Same vulnerability
- CVE-2024-8309 Langchain SQL Injection vulnerability Also affects langchain
- CVE-2026-41182 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-rr7j-v2q5-chgv LangSmith SDK: Streaming token events bypass output redaction Also affects langsmith
- CVE-2026-25528 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-v34v-rq6j-cj6p LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection Also affects langsmith
- GHSA-fw9q-39r9-c252 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__`… Also affects langsmith
- CVE-2026-40190 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith