Attack Chain

1. An attacker creates a malicious prompt manifest containing a serialized LangChain object with a modified base_url parameter pointing to an attacker-controlled server.
2. The attacker publishes this malicious prompt to the LangSmith Hub, making it available to the public.
3. A victim application calls pull_prompt (Python) or pullPrompt (JS/TS) using the owner/name identifier of the attacker’s malicious prompt.
4. The LangSmith SDK fetches the malicious prompt manifest from the LangSmith Hub.
5. The SDK deserializes the manifest, instantiating the LangChain object with the attacker-supplied base_url.
6. The victim application sends requests to the configured LLM client. Due to the malicious base_url, these requests are redirected to the attacker-controlled server.
7. The attacker’s server intercepts the redirected requests, potentially capturing prompt contents, system prompts, retrieved context, model parameters, provider credentials, or other secrets.
8. The attacker gains unauthorized access to sensitive information or manipulates the application’s behavior.

Impact

Successful exploitation of this vulnerability can lead to severe consequences, including Server-Side Request Forgery (SSRF), where outbound requests are redirected to attacker-controlled servers, potentially exposing sensitive information. Prompt injection and behavior manipulation are also possible by embedding attacker-controlled system messages or prompt templates. The impact extends to applications using vulnerable versions of LangSmith SDK, with the potential for data breaches and unauthorized access. This vulnerability is tracked as CVE-2026-45134 and has a high severity rating.

Recommendation

• Upgrade to LangSmith SDK Python version 0.8.0 or later, or JS/TS version 0.6.0 or later, to address the vulnerability.
• Explicitly acknowledge the trust boundary when pulling public prompts by passing dangerously_pull_public_prompt=True (Python) or dangerouslyPullPublicPrompt: true (JS/TS) to the pull_prompt or pullPrompt methods.
• Review and validate the contents of public prompts before using them, especially those pulled using the owner/name identifier.
• Avoid passing secrets_from_env=True (Python) when pulling untrusted prompts to prevent environment variable leakage during deserialization.
• Treat prompts as executable configuration and apply thorough review and audit practices, especially within your own organization, as compromised API keys can lead to malicious prompt injection.
• Deploy the Sigma rule “Detect LangSmith Public Prompt Pull Opt-In” to monitor for explicit opt-in to pulling public prompts, indicating a potential risk area.