CVE-2026-40190

critical

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform.

Vendor / product: Langchain — langsmith

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the __proto__ key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. This vulnerability is fixed in 0.5.18.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-04-10 20:16

Modified: 2026-10-26 21:10

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 07:07 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

langchain / langsmith <0.5.18

Weakness classification (CWE)

CWE-1321

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252

Patch / mitigation: https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252

References

https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252 security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2025-68665