langsmith-sdk vulnerabilities

2 known vulnerabilities in langsmith-sdk from LangChain AI. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  langsmith-sdk: Deserialization of Untrusted Data

  CVE-2026-45134May 27, 2026LangChain AI

  LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) f

• 9.8 Critical severity

  langsmith-sdk: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-40190Apr 10, 2026LangChain AI

  LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssign