Prototype pollution in langsmith-sdk - CVE-2026-40190
Published: April 11, 2026
Vulnerability identifier: #VU125825
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-40190
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: LangChain
Affected software:
langsmith-sdk
langsmith-sdk
Detailed vulnerability description
The vulnerability allows a remote attacker to modify object prototype attributes.
The vulnerability exists due to improperly controlled modification of object prototype attributes in the internal lodash set() utility used by the createAnonymizer() API when processing attacker-controlled object keys in data being anonymized. A remote attacker can supply crafted keys using the constructor.prototype traversal path to modify object prototype attributes.
The issue can affect all objects in the Node.js process.
How to mitigate CVE-2026-40190
Install security update from vendor's website.