CVE-2026-2950
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guarded against string key members, but an attacker can bypass it by using array-wrapped path segments. This allows deletion of properties from built-in prototypes like Object.prototype.
Risk Assessment
The vulnerability allows modification of object prototypes, which can lead to unexpected application behavior or further attacks, though it does not allow overwriting original behavior.
Recommendation
Update Lodash to version 4.18.0 or later, which contains the fix.
Other vulnerabilities in Lodash
See all- CVE-2026-4800High
Lodash versions before 4.18.0 do not properly validate key names in the options.imports option of _.template. An attacker can inject default-parameter expressions that execute arbitrary code during template compilation. Additionally, prototype pollution can lead to similar attacks.
- CVE-2025-13465Medium
A vulnerability in Lodash versions 4.0.0 through 4.17.22 allows prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths that cause Lodash to delete methods from global prototypes.
Original NVD description (English source)
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS