EUVD-2026-21594
GHSA-fw9q-39r9-c252
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N since data can arrive remotely and PR:N as no auth is inherent, but AC:H because the app must use createAnonymizer on attacker-keyed input and real impact needs a gadget; C/I/A:L reflect the partial technical impact.
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
10DescriptionNVD
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the __proto__ key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. This vulnerability is fixed in 0.5.18.
AnalysisAI
Prototype pollution in the LangSmith JavaScript/TypeScript SDK (npm 'langsmith', versions <= 0.5.17) lets an attacker who controls object keys passed to the createAnonymizer() API pollute Object.prototype for the entire Node.js process. The internally vendored lodash set() utility guards only the __proto__ key and misses the constructor.prototype traversal path, so a crafted key like 'constructor.prototype.polluted' bypasses the fix. Publicly available exploit code exists (SSVC 'poc' plus regression tests in the fix PR), but EPSS is only 0.04% with no evidence of active exploitation; notably the vendor GHSA rates this Medium (~CVSS 5.6), conflicting sharply with the NVD 9.8.
Technical ContextAI
The flaw is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) in Node.js. The SDK ships its own copy of lodash's set() at js/src/utils/lodash/. Its baseAssignValue() function special-cases only the literal key '__proto__' (via Object.defineProperty) and otherwise does a raw object[key] = value assignment. Because castPath() splits a dotted path such as 'constructor.prototype.polluted' into ['constructor','prototype','polluted'] and baseSet() walks that chain, execution reaches Object.prototype and assigns the terminal key there - the guard never triggers because that final key is not '__proto__'. The reachable sink is createAnonymizer() (importable as langsmith/anonymizer): extractStringNodes() recursively walks input objects building dotted paths from their keys, and the masking step later feeds those attacker-influenced paths back into the vulnerable set(). The affected package per CPE is cpe:2.3:a:langchain-ai:langsmith-sdk. The Python SDK on PyPI does not use lodash and is not affected.
RemediationAI
Vendor-released patch: upgrade the npm 'langsmith' package to 0.5.18 or later, which rewrites the anonymizer to write values back through direct parent-object/key references and eliminates the path-parsing set() call entirely, removing the pollution sink. The fix is in PR https://github.com/langchain-ai/langsmith-sdk/pull/2690 and commit 31d3c3aec02892f4312baae112f817d6b2f0ebe3; see advisory https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252. If you cannot upgrade immediately, the concrete compensating control is to avoid passing untrusted or attacker-influenced data to createAnonymizer()/langsmith/anonymizer, or to sanitize/reject input object keys matching 'constructor', 'prototype', or '__proto__' before anonymization - the trade-off is that legitimate data containing those literal key names will be dropped or rejected. Freezing Object.prototype (Object.freeze) process-wide can also blunt pollution but risks breaking libraries that legitimately write to prototypes and is not a substitute for the patch.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today