Database/AI/ML frameworks & serving
LangSmith SDK: pulling a public Hub prompt deserializes attacker-controlled LangChain objects
Impact
The SDK's prompt pull methods fetch a manifest from the LangSmith Hub and deserialize it into LangChain objects and model configuration without distinguishing a public, third-party-owned prompt from one inside the caller's own organization. Anything on the fleet that pulls a prompt by owner/name - an agent worker, a batch inference job, a notebook - takes runtime behavior from a party outside the operator's control, which can redirect model calls or leak data the process holds (API keys, tenant inputs). On a GPU node this is a code-behavior change inside a long-lived serving or training process that already holds credentials for the cluster. The record rates it confidentiality-high and requires that someone actually pull such a prompt.
Who can reach it
No authentication to the victim's systems. The attacker only needs to publish or control a public prompt on the LangSmith Hub; a user or job on the fleet must then pull it by owner/name.
What to do
Upgrade to LangSmith SDK Python 0.8.0 or JS/TS 0.6.0 and restart the processes that import it - serving workers, agent runners, notebook kernels. No node reboot or firmware work. Until then, restrict prompt pulls to identifiers owned by your own organization.
References
Related entries
- picklescan: `scan_pytorch` bypass via forged magic numbersCVE-2026-53875 · picklescanHigh
- NVIDIA Megatron-LM: hash collisions in the inference cache let one request's data reach anotherCVE-2026-65104 · NVIDIA Megatron-LM (inference request cache)High
- torchvision (GIF decoder): Out-of-bounds heap read in `read_from_tensor` GIF decodeCVE-2026-65918 · torchvision (GIF decoder)High
- MLflow: model version creation reads another user's run artifacts without READ permissionCVE-2026-69148 · MLflow tracking server (CreateModelVersion source run/model validation)High
- MLflow AI Gateway: unvalidated api_base in gateway secrets turns the proxy endpoint into an authenticated SSRFCVE-2026-71211 · MLflow AI Gateway (gateway secret auth_config.api_base, raw_proxy endpoint)High
- Hugging Face tokenizers: crafted tokenizer.json aborts the process while loading a BPE modelCVE-2026-85670 · Hugging Face tokenizers (BpeBuilder::build, BPE merge loading)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.