CVE-2026-40190 Details
Description
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the __proto__ key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. This vulnerability is fixed in 0.5.18.
A prototype pollution vulnerability has been identified in the LangSmith JavaScript/TypeScript SDK (version 0.5.17 and prior). The issue arises from an incomplete fix in the internally vendored lodash 'set()' utility, which fails to adequately guard against prototype traversal via 'constructor.prototype'. This flaw allows an attacker to manipulate 'Object.prototype', impacting all objects within the Node.js process. The vulnerability can be exploited through the 'createAnonymizer()' API by crafting data that traverses the prototype chain, leading to unauthorized access or manipulation of object properties.
Users should update to LangSmith SDK version 0.5.18, where this vulnerability has been fixed. After updating, verify that the 'baseAssignValue()' function in 'lodash' properly guards against 'constructor' and 'prototype' keys to prevent similar issues.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252 | [email protected] | ExploitVendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| langchain langsmith | < 0.5.18 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |