# Deserialized LangSmith Prompt Manifest Combines secrets_from_env With an Attacker base_url Override

- **Severity:** High
- **Signature ID:** `1c749954-ab44-42d5-a5b6-739474d19aac`
- **CVEs:** CVE-2026-45134
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure), LLM05 (Improper Output Handling)

## Summary

LangSmith lets applications pull reusable prompts from a shared hub by owner and name. Because these pulled prompts are treated as executable configuration rather than plain text, a malicious or compromised prompt can secretly redirect where your AI application sends its requests and can grab environment variables in the process.

## How the attack works

An attacker publishes or compromises a prompt in the LangSmith Hub identified by owner/name. A victim application pulls that prompt, either by explicitly bypassing the SDK's safety check for public prompts, or by deserializing a manifest that sets two things together: a flag to read secrets from environment variables, and a base_url/api_base/endpoint override pointing at an attacker-controlled server. Once deserialized, the manifest reconfigures the LLM client so that system prompts, retrieved context, and provider credentials are sent to the attacker's endpoint instead of the intended one. The attacker gets a copy of sensitive data and any environment secrets pulled in during that process.

## Why it matters

Organizations can leak system prompts, retrieved documents, and LLM provider API keys or credentials to an attacker-controlled server, and expose environment variables to a third party, without any visible error in the application.

## What you can do

- Never enable the 'dangerously_pull_public_prompt' override for prompts from untrusted or public owners.
- Pin prompt manifests to reviewed, trusted versions instead of pulling live from public owner/name identifiers.
- Restrict which base_url/api_base/endpoint values your LLM client configuration is allowed to accept, ideally via an allowlist enforced outside the manifest itself.
- Avoid combining secrets_from_env with a hub-supplied prompt manifest; keep credential loading separate from remotely fetched configuration.

## Known benign look-alikes

- A pull_prompt/pullPrompt call against a public owner/name identifier WITHOUT the dangerously_pull_public_prompt override flag -- the SDK's default-safe path rejects this, so it is not exploitable and not flagged
- A deserialized manifest setting secrets_from_env=true alone, or base_url alone, without the other -- each individually has legitimate uses (e.g. a trusted same-org prompt configuring a private Azure endpoint); only the combination that both reads env secrets AND redirects the endpoint is flagged
- Documentation or a security advisory discussing the CVE-2026-45134 parameter names without an actual manifest or tool call setting them
- secrets_from_env combined with a base_url/openai_api_base/azure_endpoint pointing at a recognized major-cloud LLM domain (*.azure.com, *.amazonaws.com, *.googleapis.com, *.openai.com, *.anthropic.com) or an internal/corp/local/private-IP endpoint -- ADVERSARIALLY CONFIRMED as real false positives during review (a company's own Azure OpenAI deployment, and a self-hosted internal LiteLLM proxy); fixed with a negative-lookahead domain allowlist. Residual risk: an attacker-registered domain containing 'internal'/'corp'/'local' as a substring could evade this exclusion -- treated as an accepted precision/recall tradeoff for a pattern-tier rule

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02373
- https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-3644-q5cj-c5c7
- https://github.com/advisories/GHSA-3644-q5cj-c5c7
- https://nvd.nist.gov/vuln/detail/CVE-2026-45134

---
Source: https://www.netzilo.com/threats/atr-deserialized-langsmith-prompt-manifest-combines-secrets-from