#VU125825 Prototype pollution in langsmith-sdk - CVE-2026-40190
Published: April 11, 2026
Vulnerability identifier: #VU125825
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-40190
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
langsmith-sdk
langsmith-sdk
Software vendor:
LangChain
LangChain
Description
The vulnerability allows a remote attacker to modify object prototype attributes.
The vulnerability exists due to improperly controlled modification of object prototype attributes in the internal lodash set() utility used by the createAnonymizer() API when processing attacker-controlled object keys in data being anonymized. A remote attacker can supply crafted keys using the constructor.prototype traversal path to modify object prototype attributes.
The issue can affect all objects in the Node.js process.
Remediation
Install security update from vendor's website.