CVE-2026-2950
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guarded against string key members, but an attacker can bypass it by using array-wrapped path segments. This allows deletion of properties from built-in prototypes like Object.prototype.
Risk Assessment
The vulnerability allows modification of object prototypes, which can lead to unexpected application behavior or further attacks, though it does not allow overwriting original behavior.
Recommendation
Update Lodash to version 4.18.0 or later, which contains the fix.
Original NVD description (English source)
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.