Description
Severity: Medium (CVSS ~5.6) Status: Fixed in 0.5.18
Recommendation
Update the langsmith package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.5.17
- Patched version(s): 0.5.18
References
Could your website be exposed too?
SmartScanner can check your website for LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
- Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
You might also like:
See something that needs correcting? Let us knowUpdated April 10, 2026