Skip to content
Threat Feed
Subscribe

Vendor

LangChain

2 briefs RSS
high advisory

LangSmith SDK Untrusted Manifest Deserialization Vulnerability

The LangSmith SDK is vulnerable to untrusted manifest deserialization when pulling public prompts via `pull_prompt`, potentially leading to SSRF, prompt injection, or sensitive data exposure; CVE-2026-45134.

langsmith +2 deserialization ssrf prompt-injection
2r 3t
high advisory

LangChain Unsafe Deserialization Vulnerability

LangChain is vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists, potentially leading to persistent chat-history poisoning, prompt injection, credential disclosure, or server-side requests.

langchain-core langchain deserialization vulnerability
2r 1t