GHSA-fw9q-39r9-c252
Medium · 5.6CVSS
5.6
EPSS
—
Published
Apr 10, 2026
CISA due date
—
The record
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | langsmith | 0 | 0.5.18 |
Related vulnerabilities
- CVE-2026-40190 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Same vulnerability
- CVE-2026-45134 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-3644-q5cj-c5c7 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary… Also affects langsmith
- CVE-2026-41182 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-rr7j-v2q5-chgv LangSmith SDK: Streaming token events bypass output redaction Also affects langsmith
- CVE-2026-25528 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Also affects langsmith
- GHSA-v34v-rq6j-cj6p LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection Also affects langsmith
- CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-1321