The vulnerability exists because the LangSmith SDK deserializes prompt manifests fetched from the LangSmith Hub without enforcing a trust boundary. These manifests can contain serialized LangChain objects and model configuration that directly influence runtime behavior. When a client pulls a public prompt, the content is chosen by an external party, but older SDK versions treated it the same as an internal organization prompt. This flaw corresponds to deserialization of untrusted data (CWE‑502) and could allow an attacker to craft a malicious prompt that, when pulled, causes unintended code execution or configuration changes during SDK runtime.

LangSmith Client SDKs from langchain‑ai, specifically Python SDK versions earlier than 0.8.0 and JavaScript/TypeScript SDK versions earlier than 0.6.0, are vulnerable. All earlier releases incur the risk because they employ the insecure pullPrompt and pull_prompt methods.

The CVSS score of 7.1 indicates a high severity level. While no EPSS data is available, the absence of a KEV listing suggests there are no known large‑scale exploits at the time of this analysis. Exploitation requires only that a client application invokes the public prompt pull method with an attacker‑controlled prompt identifier. Because the flaw resides on the client side and does not require privileged access, the attack surface consists of any user or script that pulls public prompts from the Hub.