Описание
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0.
A flaw was found in the LangSmith Client SDKs. This vulnerability allows an external attacker to control the content of prompt manifests when a user pulls a public prompt from the LangSmith Hub. By exploiting the deserialization of untrusted data, an attacker could achieve high confidentiality impact, potentially leading to the disclosure of sensitive information and affecting the application's runtime behavior.
Отчет
This Moderate impact vulnerability in LangSmith Client SDKs can lead to information disclosure and potential integrity loss. Red Hat products using these SDKs are affected when pulling public prompts from the LangSmith Hub, as untrusted manifest content may be deserialized. This could result in the execution of malicious LangChain objects or model configurations, requiring user interaction for exploitation.
Меры по смягчению последствий
To mitigate this vulnerability, avoid pulling public prompts from the LangSmith Hub using the LangSmith Client SDKs without explicit trust. The SDK provides a dangerously_pull_public_prompt flag (Python) or dangerouslyPullPublicPrompt (JS/TS) that must be set to True to enable pulling public prompts by owner/name. Do not enable this flag unless the prompt's contents have been independently reviewed and trusted. Additionally, when pulling prompts, avoid setting include_model=True or secrets_from_env=True if the prompt source is untrusted, as these options expand the deserialization allowlist and allow reading environment variables.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-chatbot-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-rhel9 | Not affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/disk-image-cuda-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-llama-stack-core-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0.
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
EPSS
7.1 High
CVSS3