Executive Summary

CVE-2026-40190 is a prototype pollution vulnerability in the LangSmith JavaScript/TypeScript SDK (versions up to 0.5.17). The issue arises from an incomplete fix in the internally vendored lodash set() utility, specifically in the baseAssignValue() function. This function only blocks assignment to the __proto__ key but fails to prevent prototype pollution via the constructor.prototype path.

An attacker who controls keys in data processed by the createAnonymizer() API can craft input that pollutes Object.prototype by assigning properties through paths like "constructor.prototype.polluted". This causes all objects in the Node.js process to inherit the polluted properties, affecting their behavior.

The vulnerability was fixed in version 0.5.18 by extending the guard in baseAssignValue() to block keys "constructor" and "prototype" in addition to "__proto__".

Useful 0 Not Useful 0

Impact Analysis

This prototype pollution vulnerability can have several impacts:

• Authentication bypass by injecting properties like isAdmin into all objects, causing checks such as if (user.isAdmin) to erroneously succeed.
• Potential remote code execution in template engines (e.g., Pug, EJS, Handlebars, Nunjucks) that evaluate polluted prototype properties.
• Denial of service by overwriting critical methods (toString, valueOf, hasOwnProperty) on all objects.
• Data exfiltration by polluting serialization methods.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves prototype pollution via the createAnonymizer() API in the langsmith-sdk JavaScript/TypeScript SDK versions prior to 0.5.18. Detection involves checking if objects in your Node.js process have unexpected prototype properties such as "isAdmin" or other injected keys that should not normally exist.

You can detect signs of prototype pollution by running JavaScript code in your environment to check if Object.prototype has been polluted. For example, in a Node.js environment, you can run:

• console.log(Object.prototype.isAdmin); // Should be undefined if not polluted
• console.log({}.isAdmin); // Should be undefined if not polluted

If these properties return values (e.g., true), it indicates prototype pollution.

Additionally, monitoring logs or network traffic for suspicious payloads sent to the createAnonymizer() API containing keys like "constructor.prototype" or "__proto__" can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the langsmith-sdk JavaScript/TypeScript SDK to version 0.5.18 or later, where the vulnerability is fixed by properly guarding against prototype pollution via keys "__proto__", "constructor", and "prototype".

If immediate upgrade is not possible, consider sanitizing or rejecting input data that contains suspicious path segments such as "constructor" or "prototype" before it is processed by the createAnonymizer() API.

Also, review and restrict access to the createAnonymizer() API to trusted sources only, to reduce the risk of malicious input.

Monitor your Node.js environment for signs of prototype pollution and restart affected services to clear polluted prototypes if detected.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0