On April 10, 2026, CVE-2026-40190 exposed prototype pollution in LangSmith JS SDK before 0.5.18, with chainable risk beyond tracing. Read now.
What CVE-2026-40190 actually is
CVE-2026-40190 is a prototype pollution issue in the LangSmith JS SDK affecting releases before 0.5.18. Prototype pollution is a JavaScript-specific class of bug: untrusted data is merged into an object in a way that can alter shared prototypes such as Object.prototype. Once that happens, properties you never set on a given object can suddenly appear as if they belong there. The practical effect is not limited to one function call; later code that reads defaults, flags, or nested config can inherit attacker-controlled values without ever touching the original input again.
LangSmith is commonly used for tracing and observability around AI application runs. The CVE matters because the SDK sits on the same process path as prompts, tool calls, metadata, and evaluation payloads. When pollution is possible in that layer, the blast radius is not “a broken trace viewer.” It is any downstream logic that trusts object shape, merges user or model-produced structures, or treats missing keys as safe defaults.
Why the risk extends past tracing
Tracing SDKs look passive: they record spans, attach metadata, and ship events. That passivity is misleading. Client libraries still parse responses, normalize nested objects, and merge options. If any of those steps walk keys like __proto__, constructor, or prototype without filtering, an attacker who can influence a payload can plant properties that other modules later interpret as configuration.
In AI stacks, that chain is easy to form. A polluted default can flip feature flags, rewrite base URLs used for callbacks, change timeout or retry behavior, or poison structures passed into evaluators and tool routers. The original sink may be “log this run,” while the real impact shows up in auth decisions, remote fetches, or agent control flow that never intended to trust tracing metadata. That is what “chainable risk beyond tracing” means: the vulnerability is in the SDK’s object handling, and the exploit path can cross product boundaries that share the same JavaScript runtime.
How teams should respond
Treat the version boundary as non-negotiable. Upgrade the LangSmith JS SDK to 0.5.18 or later everywhere it is declared—application packages, workers, evaluation jobs, and local tooling. Pin the fixed range in lockfiles so transitive installs cannot quietly reintroduce an older client. After upgrading, rebuild and redeploy rather than assuming a hot patch of node_modules alone is enough.
- Inventory every service that imports the SDK, including offline batch jobs and CI evaluation runners.
- Search for custom merge helpers that deep-assign untrusted JSON into plain objects; those remain risky even after the SDK fix.
- Prefer
Object.create(null)or Map-based stores for untrusted key/value bags so prototype chains are not in play. - Reject or strip prototype-related keys at trust boundaries before any recursive merge.
Hardening AI client code going forward
Prototype pollution is not unique to one library; AI pipelines amplify it because they constantly serialize and rehydrate nested structures from models, tools, and third-party APIs. Design merges so untrusted input can only write to an allowlisted set of fields. Validate types after parse—strings stay strings, booleans stay booleans—and fail closed when shape checks fail. Keep tracing metadata out of security-sensitive decisions: do not let span attributes drive authorization, egress targets, or tool allowlists.
If you cannot upgrade immediately, isolate the SDK behind a thin wrapper that sanitizes inbound objects and never deep-merges raw payloads into shared config. That is a temporary control, not a substitute for 0.5.18+. The durable fix is a current SDK plus application code that treats every nested object from outside the process as hostile until proven otherwise.