EUVD-2026-21594
GHSA-fw9q-39r9-c252
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N since data can arrive remotely and PR:N as no auth is inherent, but AC:H because the app must use createAnonymizer on attacker-keyed input and real impact needs a gadget; C/I/A:L reflect the partial technical impact.
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
10DescriptionNVD
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the __proto__ key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. This vulnerability is fixed in 0.5.18.
AnalysisAI
Prototype pollution in the LangSmith JavaScript/TypeScript SDK (npm 'langsmith', versions <= 0.5.17) lets an attacker who controls object keys passed to the createAnonymizer() API pollute Object.prototype for the entire Node.js process. The internally vendored lodash set() utility guards only the __proto__ key and misses the constructor.prototype traversal path, so a crafted key like 'constructor.prototype.polluted' bypasses the fix. Publicly available exploit code exists (SSVC 'poc' plus regression tests in the fix PR), but EPSS is only 0.04% with no evidence of active exploitation; notably the vendor GHSA rates this Medium (~CVSS 5.6), conflicting sharply with the NVD 9.8.
Technical ContextAI
The flaw is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) in Node.js. The SDK ships its own copy of lodash's set() at js/src/utils/lodash/. Its baseAssignValue() function special-cases only the literal key '__proto__' (via Object.defineProperty) and otherwise does a raw object[key] = value assignment. Because castPath() splits a dotted path such as 'constructor.prototype.polluted' into ['constructor','prototype','polluted'] and baseSet() walks that chain, execution reaches Object.prototype and assigns the terminal key there - the guard never triggers because that final key is not '__proto__'. The reachable sink is createAnonymizer() (importable as langsmith/anonymizer): extractStringNodes() recursively walks input objects building dotted paths from their keys, and the masking step later feeds those attacker-influenced paths back into the vulnerable set(). The affected package per CPE is cpe:2.3:a:langchain-ai:langsmith-sdk. The Python SDK on PyPI does not use lodash and is not affected.
RemediationAI
Vendor-released patch: upgrade the npm 'langsmith' package to 0.5.18 or later, which rewrites the anonymizer to write values back through direct parent-object/key references and eliminates the path-parsing set() call entirely, removing the pollution sink. The fix is in PR https://github.com/langchain-ai/langsmith-sdk/pull/2690 and commit 31d3c3aec02892f4312baae112f817d6b2f0ebe3; see advisory https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252. If you cannot upgrade immediately, the concrete compensating control is to avoid passing untrusted or attacker-influenced data to createAnonymizer()/langsmith/anonymizer, or to sanitize/reject input object keys matching 'constructor', 'prototype', or '__proto__' before anonymization - the trade-off is that legitimate data containing those literal key names will be dropped or rejected. Freezing Object.prototype (Object.freeze) process-wide can also blunt pollution but risks breaking libraries that legitimately write to prototypes and is not a substitute for the patch.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today