LangChain LangSmith SDK Deserialization Vulnerability CVE-2024-45134 Analysis

Vulnerability Overview Vulnerability Title: Public prompt pull deserializes untrusted manifests without trust boundary warning Vulnerability ID: GHSA-3644-q5cj-c5c7 Publication Date: 3 weeks ago Reporter: eyartsev Severity: High (7.1 / 10) CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: Low Availability: None CVE ID: CVE-2024-45134 Affected Versions: langchain-classic = 1.0.7 langchain >= 0.3.30 langsmith >= 0.8.0 langsmith (npm) >= 0.6.0 Description The LangSmith SDK's prompt pull methods ( / in Python, / in JSTS) fetch and deserialize prompt objects and model configurations from the LangSmith Hub. These prompts may contain serialized LangChain objects and model configurations that affect runtime behavior. When pulling public prompts identified by identifiers, the prompt content is controlled by external parties, but older versions of the SDK failed to distinguish whether the prompt originated from the caller's own organization or from an external party. Prompt manifests can be intentionally configured with custom base URLs, default headers, model names, or other constructor arguments. While these are supported features, they also mean that prompt content should be treated as executable configuration rather than plain text. Prompts can also contain serialized LangChain Runnable or PromptTemplate objects with attacker-controlled constructor arguments or secret references, which read environment variables during deserialization if is enabled. An application is exposed when the following conditions are met: The application calls or (Python) or / (JSTS) with a public prompt identifier. The prompt is published or modified by an untrusted or compromised account. The application uses the pulled prompt without independent verification. Applications pulling prompts exclusively from their own organization (referenced only by name, without an prefix) are not affected by the aforementioned public prompt trust boundary issue. However, same-organization prompts still pose risks. If an attacker gains write access to the organization (e.g., via a leaked or a compromised team member account), they can push malicious prompts without issuing any additional warnings. Impact An attacker who publishes a malicious prompt to the LangSmith Hub may be able to influence applications that pull prompts via . If the prompt manifest reaches the SDK's deserialization path, the SDK will instantiate the referenced LangChain objects using the attacker-provided constructor arguments, rather than treating the manifest as inline data. Real-world impacts include: Server-Side Request Forgery (SSRF), outbound request redirection, and interception of LLM traffic if the prompt manifest configures an LLM client with attacker-controlled , , or equivalent endpoint settings. In typical deployments, redirected requests may include the prompt manifest, system prompts, retrieved context, model parameters, provider credentials, or other secrets, potentially disclosing them to attacker-controlled endpoints. Prompt injection or behavior manipulation if the prompt embeds attacker-controlled system messages, prompt templates, or model parameters that alter application behavior. Additional deserialization risks when is passed, as this extends the allowance for deserializing partner integration classes. This is not the default setting, but it does increase the risk when pulling prompts from outside the caller's organization. Remediation The LangSmith SDK now blocks pulling public prompts via by default. Callers must explicitly opt-in by passing (Python) or (JSTS). This flag should only be set after reviewing and trusting the prompt content, not merely the publishing account. Upgrade to LangSmith SDK Python >= 0.8.0 or JSTS >= 0.6.0. Guidance on Prompt Pull Methods The prompt pull methods ( / in Python, / in JSTS) should only be used with trusted prompts. Do not pull prompts from untrusted or unreviewed sources via without understanding that the prompt content will be deserialized and may affect runtime behavior. When pulling prompts that include model configurations ( in Python, in JSTS), deserialization is extended to include partner integration classes. Since this is not the default setting and is generally unnecessary for third-party prompts, prefer the default value ( ) when pulling prompts from sources outside the organization. Avoid passing (Python) or setting this parameter when pulling untrusted prompts. This parameter allows the prompt manifest to read environment variables during deserialization. Use it only for trusted prompts from your own organization. Same-Organization Prompts Prompts pulled from the caller's own organization (referenced only by name, without an prefix) are not affected by the new flag, but they are not entirely safe. If an attacker gains write access to the organization (e.g., via a leaked or a compromised tea

Goal Reached Thanks to every supporter — we hit 100%!

LangChain LangSmith SDK Deserialization Vulnerability CVE-2024-45134 Analysis

More from this source