PYSEC-2026-2560 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Description The LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

Arbitrary Code Execution

GitHub Copilot CLI is vulnerable to Arbitrary Code Execution. The vulnerability is due to unsafe handling of Git repository configuration during repository discovery, where a malicious nested bare Git repository can define executable configuration options that are automatically invoked during Git...

EUVD-2020-4779

Malware in sbrugna...