LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set(

Description

Severity: Medium (CVSS ~5.6) Status: Fixed in 0.5.18

Recommendation

Update the langsmith package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.5.17
• Patched version(s): 0.5.18

References

• GHSA-fw9q-39r9-c252
• CVE-2026-40190
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
• Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

langsmith