LangSmith SDK EUVD-2026-21594

Exploitation requires the host Node.js application to use the langsmith createAnonymizer() API (langsmith/anonymizer) AND to pass it data whose object keys are attacker-controlled; the attacker supplies a key such as 'constructor.prototype.<prop>'. Limiting factors: this is not exploitable against a default or idle install - the anonymizer feature must be in use on an untrusted input path, the version must be <= 0.5.17, and the runtime must be Node.js (the flaw pollutes Object.prototype). Real-world impact beyond process-wide pollution further depends on the presence of an exploitable prototype-pollution gadget in the application or its dependencies, which is why SSVC rates technical impact only 'partial'. The NVD PR:N/AC:L rating understates that the anonymizer-with-untrusted-keys precondition is required.

The signals conflict and should not be taken at face value. NVD publishes CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A High), but the vendor's own GHSA advisory rates it Medium (~5.6) and the SSVC decision records Technical Impact as only 'partial' with Automatable 'no'. EPSS is very low at 0.04% (12th percentile), it is not in CISA KEV, and there is no evidence of exploitation in the wild. The realistic impact of prototype pollution here is not guaranteed remote code execution - it is process-wide object corruption whose consequence (DoS, logic bypass, or RCE) depends on the presence of a suitable gadget chain in the host application, which the SDK cannot guarantee. Crucially, the 9.8 assumes a direct network/no-privilege path, yet exploitation actually requires the consuming application to (a) use the createAnonymizer() feature and (b) feed it data whose object keys the attacker controls - a meaningful precondition the raw CVSS omits. Treat this as a Medium-priority library-hygiene fix for applications that anonymize untrusted input, not a drop-everything internet-facing RCE. The 9.8 appears inflated versus the vendor and SSVC assessment - verify against the GHSA before prioritizing.

An application uses langsmith's createAnonymizer() to redact secrets from user-supplied JSON before logging to LangSmith. An attacker submits a payload whose object key is 'constructor.prototype.isAdmin' (as demonstrated in the fix's regression test); when the anonymizer processes it, Object.prototype.isAdmin is set for every object in the Node.js process, enabling authorization-logic bypass or denial of service. Proof-of-concept input exists in the patch test suite, and the attack is network-reachable but requires the app to actually anonymize attacker-controlled data.