{
 "id": "AIR-2026-0655",
 "slug": "cve-2026-45134-langsmith-sdk-insecure-prompt-manifest-deseri",
 "title": "CVE-2026-45134: LangSmith SDK insecure prompt manifest deserialization",
 "summary": "The LangSmith SDK fetches and deserializes external prompt manifests from the LangSmith Hub without trust boundary validation. This flaw allows malicious manifests to affect runtime behavior and execute untrusted objects.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "LangSmith SDK"
 ],
 "incident_date": "2026-05-13",
 "incident_date_precision": "day",
 "first_reported": "2026-05-13",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-3644-q5cj-c5c7",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-45134: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning",
   "published_at": "2026-05-13"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45134",
   "publisher": "NVD",
   "title": "CVE-2026-45134: LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform.",
   "published_at": "2026-05-27"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-45134",
  "deserialization"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}