PT-2026-32040 · Langchain Ai · Langsmith-Sdk

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40190

NVD

CVSS v3.1

5.6

Medium

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the proto key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. This vulnerability is fixed in 0.5.18.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-40190

Affected Products

Langsmith-Sdk

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40190 · Security Note
• https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252 · Note