The langsmith SDK versions before 0.5.18 contain a prototype pollution vulnerability due to an incomplete patch in the lodash set() utility used internally. Specifically, the baseAssignValue() function only guards against the __proto__ key but does not prevent prototype pollution through constructor.prototype traversal. This allows attackers who can influence keys passed to the createAnonymizer() API to modify Object.prototype, potentially affecting all objects in the Node.js runtime environment. The vulnerability is addressed in langsmith SDK version 0.5.18.

Successful exploitation allows an attacker to modify Object.prototype in the Node.js process using the vulnerable langsmith SDK, which can lead to unexpected behavior or security issues in applications relying on this SDK. The impact includes potential confidentiality, integrity, and availability losses as indicated by the CVSS vector (C:L/I:L/A:L). No known exploits in the wild have been reported.

Upgrade the langsmith SDK to version 0.5.18 or later, where this prototype pollution vulnerability is fixed. Since this is a client SDK and not a cloud service, remediation requires updating the affected software in your environment. Patch status is confirmed by the vendor advisory stating the fix is included in version 0.5.18.