CVE-2026-40190

CVE-2026-40190 is a prototype pollution vulnerability in the LangSmith JavaScript/TypeScript SDK (langsmith) prior to version 0.5.18. The vulnerability exists in the internally vendored lodash set() utility function, where incomplete input validation allows attackers to bypass prototype pollution protections by traversing via constructor.prototype rather than the blocked __proto__ key. This flaw affects the createAnonymizer() API and can allow attackers who control input data to pollute Object.prototype, impacting all objects within the affected Node.js process. The vulnerability has a CVSS score of 5.6 (MEDIUM) with a network-based attack vector and high attack complexity. It requires no user interaction or special privileges and can result in limited impacts across confidentiality, integrity, and availability. The EPSS score of 0.00052 indicates this CVE ranks higher than only a small percentage of known vulnerabilities in terms of exploitation probability. There is currently no evidence of active exploitation in the wild, as this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows inactive status on security tracking lists. No public exploit code appears to be readily available, and community attention remains minimal. Organizations using the LangSmith SDK should apply the patch to version 0.5.18 or later as a routine maintenance measure rather than an emergency response.