CVE-2026-40190 is a prototype pollution flaw in the LangSmith JavaScript SDK, scored CVSS 5.6. An incomplete fix in its vendored lodash set function lets crafted keys reach Object.prototype through createAnonymizer. Upgrade the langsmith npm package to 0.5.18 or later. It is a small version bump.
What's affected
- Affected: the langsmith npm package, version 0.5.17 and earlier
- Fixed: 0.5.18
- Not affected: the Python SDK on PyPI, which the advisory says does not use the same pattern
The advisory says the vendored baseAssignValue guard only blocks the proto key and misses the constructor and prototype path. The route to it is the createAnonymizer API, imported from langsmith/anonymizer.
How to check if you're exposed
Find the version in your project:
npm ls langsmith
For yarn or pnpm, use their why or list commands. Then search your code for use of the anonymizer:
grep -rn "createAnonymizer\|langsmith/anonymizer" src
If you do not call it, the vulnerable path is not used in your code. Upgrading is still the clean answer. This is a case where reachability matters, since the weak function is only hit through that API.
What to do now
- Upgrade langsmith to 0.5.18 or later and commit the lock file.
- Check whether you call createAnonymizer on data whose keys come from outside your control.
- Rebuild and redeploy any service or container that bundles the SDK.
- Add a dependency check to CI so the next one is caught on the pull request.
Why it matters
The weakness is CWE-1321, improperly controlled modification of object prototype attributes. In JavaScript, changing Object.prototype affects every object in the process, which can turn into unexpected behaviour or security bypasses depending on what the application reads from plain objects.
The score is medium because the attack complexity is high and the route is narrow. It is a good example of a flaw that is easy to dismiss and easy to settle with a version bump. The record does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I do not use createAnonymizer. Do I still upgrade?
Yes, it is a patch version bump and removes the question. The advisory ties the exposure to that API, so your urgency is lower.
Sources
Last reviewed: 19 October 2026.
