PT-2026-32040 · Langsmith+1 · Langsmith+1
Published
2026-04-10
·
Updated
2026-05-18
·
CVE-2026-40190
CVSS v3.1
5.6
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
LangSmith versions prior to 0.5.18
Description
The LangSmith JavaScript/TypeScript SDK (langsmith) contained an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guarded against the proto key, failing to prevent traversal via constructor.prototype. This allowed an attacker controlling keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. The vulnerability stemmed from a missing guard for 'constructor' and 'prototype' keys within the baseAssignValue() function, enabling traversal to Object.prototype when using paths like 'constructor.prototype.polluted'. The createAnonymizer() API processes data by extracting string nodes and applying regex replacements, ultimately writing back with the set() function. An attacker could craft malicious input containing paths resolving to constructor.prototype.X to trigger the pollution. Prototype pollution in a Node.js process can lead to authentication bypass, remote code execution, denial of service, and data exfiltration.
Recommendations
Update to version 0.5.18 or later to address the incomplete prototype pollution fix in the lodash set() utility. As a temporary workaround, sanitize or reject path segments matching 'constructor' or 'prototype' before passing them to the set() function within the createAnonymizer() API.
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Langsmith
Lodash