{"schemaVersion":3,"id":"CVE-2026-40190","aliases":["CGA-3mfp-3xjg-6c25","CGA-565x-9rj5-rhj8","CGA-567c-mh56-fcj3","CGA-g3h3-5r62-8678","CGA-gghg-gj8h-mg6g","CGA-hj3p-m9rp-9rf6","CGA-hpmf-gr6m-wqm2","CGA-mgx8-2v3p-7w8w","GHSA-fw9q-39r9-c252","CGA-269r-wjc9-xqxq","CGA-27xc-75wq-q4w2","CGA-2cw2-gccq-cx2g","CGA-2v5v-x25c-w7m5","CGA-2w6x-7h3v-cwp7","CGA-34wh-rj56-5w55","CGA-39rm-8hxp-65jg","CGA-3c73-42hc-gpf6","CGA-3gfj-qq9q-92wh","CGA-3jvg-m8h5-4553","CGA-3p8w-v3h2-vw33","CGA-3vf9-p284-ghrw","CGA-3wrw-vwcw-mr7x","CGA-432c-8hf9-2vjc","CGA-47m7-6p89-hcg4","CGA-4r7f-hvqg-848r","CGA-54j7-w3xg-gm54","CGA-579v-jg6g-j6mf","CGA-588r-p87x-r98j","CGA-58jq-6pvx-hwfg","CGA-5cxq-h92p-6rqj","CGA-63hx-p9h5-mgw4","CGA-67xm-5868-cmfp","CGA-6jv3-7j74-6w9j","CGA-6mcm-x8x3-6hh3","CGA-738x-2648-4r7g","CGA-74gw-qppx-8cg2","CGA-74pw-vm93-v4fq","CGA-765h-vwj6-h3mc","CGA-76r4-qf56-6qg2","CGA-7c93-892c-77pr","CGA-7v8x-j65f-2j5q","CGA-7vgj-m55m-6q2q","CGA-7w2g-m78m-9937","CGA-7xhr-2vfh-qhqg","CGA-83vp-m7v4-82gh","CGA-8c76-2cvw-2xv7","CGA-8g38-h9vr-vgm6","CGA-8jch-j6ph-j6gr","CGA-8jp9-w3vx-mcfv","CGA-8v5x-4ch5-45cr","CGA-92x9-ff55-25jc","CGA-9572-p4vw-j6rj","CGA-95pg-63xx-ph7f","CGA-9pv5-8x3h-gx7v","CGA-9r97-8gx2-5qpq","CGA-9vfj-r454-887q","CGA-9x23-grwv-jfr5","CGA-c9c3-2qfc-xvhc","CGA-cc39-c674-83xf","CGA-cg33-hfgv-36pq","CGA-cm4x-rgcg-jx3h","CGA-cw6f-25x4-7qjr","CGA-f4hq-85pv-j29j","CGA-f6pc-fvhj-rxj9","CGA-f85w-f47w-jhv2","CGA-ffq7-gph7-gqvm","CGA-fhwv-98p4-hpf2","CGA-fp8r-pxp4-cvr2","CGA-g4fh-gvwp-cwqh","CGA-g4h8-vgrg-gvwm","CGA-g82q-v378-8gw3","CGA-gc9g-h342-qhmx","CGA-gh4v-xc7c-59x5","CGA-ghvp-fr3p-j2v5","CGA-gjv3-8h8c-fq6w","CGA-h4c2-r4wj-8r2j","CGA-h5xh-9xmw-5rx2","CGA-h8wp-jr47-27w5","CGA-hg66-mgr5-47jp","CGA-hh4f-m682-8grf","CGA-hjx5-qrvq-4cm9","CGA-hvm7-m7gj-wxgf","CGA-j28j-6m9j-5r2q","CGA-j57r-8hgj-rpjq","CGA-j5mj-99vq-hww8","CGA-j9mw-hj3m-4683","CGA-jj38-3f3q-pr5f","CGA-jw94-g3h3-52fm","CGA-m4jw-x683-pqj4","CGA-m62p-3p86-5pw8","CGA-m7hc-h592-rm4p","CGA-m9f8-wqjc-9gv4","CGA-mq73-pmgr-5wwc","CGA-mrxv-3q5q-27p8","CGA-mw86-mqmm-25hp","CGA-mwmp-24rh-xv2w","CGA-mx24-qrvp-w476","CGA-mxrg-rrjx-fcm9","CGA-p3q5-3ppv-hvjc","CGA-p4cv-g6rq-mcqv","CGA-p53v-hp4p-v472","CGA-p5g4-wpcc-2w24","CGA-p6w4-647j-q453","CGA-p85p-qgwf-j2h5","CGA-pcvh-pgj7-rvqj","CGA-pg8h-cm77-xp68","CGA-ppq9-mgqp-3g4v","CGA-pvcp-89r4-4q3c","CGA-pvvw-h545-g99c","CGA-px93-4qg6-jf6q","CGA-q8q6-cj2x-wf96","CGA-qh9h-wprm-3mj9","CGA-qq2f-jvqc-9873","CGA-qvpv-c577-m9rh","CGA-qw3w-x5c6-7rph","CGA-r5v6-m8xj-v46f","CGA-r5w4-cv9f-grf4","CGA-r8w5-fvhq-rgpx","CGA-rmr9-3rp3-c74v","CGA-rqj8-24pj-3vc2","CGA-rvpf-ww2v-82v5","CGA-rw3v-67g5-7g22","CGA-v349-3v23-x832","CGA-v42j-pv3j-22wg","CGA-vm9h-4544-4pgm","CGA-vpr8-6p6h-r58g","CGA-vwrf-9457-6f6j","CGA-vwxm-32jf-hv2x","CGA-w2w5-269m-mrr3","CGA-w5cm-8xjq-5hj6","CGA-w673-r9wg-mjp8","CGA-w8pm-wpp5-8c44","CGA-whj6-wrg2-3rj6","CGA-wmg3-44vw-36fr","CGA-wr9p-8qw8-vq5v","CGA-wv48-rqc7-83m3","CGA-x4r3-gwc8-j7x3","CGA-xqpx-hg5w-h2qr","CGA-xvx2-hm37-5ghm","CGA-xx85-xggx-6qxx","CGA-xxmp-2r6g-8475"],"status":"published","duplicateOf":null,"title":null,"description":"LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the __proto__ key, but fails to prevent traversal via constructor.prototype. This allows an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype, affecting all objects in the Node.js process. This vulnerability is fixed in 0.5.18.","dates":{"published":"2026-04-10T19:47:57.642Z","modified":"2026-04-13T16:13:45.532Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":5.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":5.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":5.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00385,"percentile":0.31158,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.07200000000000001,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00313},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00385,"percentile":0.31158}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00385,"percentile":0.31158}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_LANGCHAIN-AI_LANGSMITH-SDK","name":"Langsmith Sdk","source":"github","url":"https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"kibana-8.17","name":"kibana-8.17","label":"kibana-8.17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17","purlType":"apk","versions":[{"text":"< 8.17.10-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-bitnami","name":"kibana-8.17-bitnami","label":"kibana-8.17-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-bitnami","purlType":"apk","versions":[{"text":"< 8.17.10-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-iamguarded","name":"kibana-8.17-iamguarded","label":"kibana-8.17-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-iamguarded","purlType":"apk","versions":[{"text":"< 8.17.10-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18","name":"kibana-8.18","label":"kibana-8.18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-bitnami","name":"kibana-8.18-bitnami","label":"kibana-8.18-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-bitnami","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-iamguarded","name":"kibana-8.18-iamguarded","label":"kibana-8.18-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.14-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.14-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.14-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.14-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.14-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.14-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.7-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.7-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.7-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.7-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.3-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.3-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.3-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.3-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.164.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.164.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.164.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.164.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.4-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.164.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.164.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r6","eol":null,"hubHref":null},{"vendor":"langchain-ai","product":"langsmith-sdk","name":"langsmith-sdk","label":"langsmith-sdk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.5.18","eol":null,"hubHref":"/vendor/langchain-ai/langsmith-sdk"},{"vendor":"langchain","product":"langsmith","name":"langsmith","label":"langsmith","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.5.18","eol":null,"hubHref":"/vendor/langchain/langsmith"},{"vendor":"Npm","product":"langsmith","name":"langsmith","label":"langsmith","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/langsmith","purlType":"npm","versions":[{"text":"< 0.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.5.18","eol":null,"hubHref":null}],"affectedCount":31,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252","label":"github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-fw9q-39r9-c252","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Exploit","Vendor Advisory","Mitigation"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40190","label":"nvd.nist.gov/vuln/detail/CVE-2026-40190","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/langchain-ai/langsmith-sdk/pull/2690","label":"github.com/langchain-ai/langsmith-sdk/pull/2690","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/langchain-ai/langsmith-sdk/commit/31d3c3aec02892f4312baae112f817d6b2f0ebe3","label":"github.com/langchain-ai/langsmith-sdk/commit/31d3c3aec02892f4312baae112f817d6b2f0ebe3","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/langchain-ai/langsmith-sdk","label":"github.com/langchain-ai/langsmith-sdk","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11284-1"],"duplicates":[],"related":["CGA-4WJJ-GWR8-WP83","OPENSUSE-SU-2026:11284-1"]},"timeline":[{"kind":"published","date":"2026-04-10T19:47:57.642Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-13T16:13:45.532Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:15:49.528Z","stale":false,"partial":false}}